[Remote] Senior Security Risk Analyst

Note: The job is a remote job and is open to candidates in USA. Muon Space is hiring a Senior Security Risk Analyst to identify, assess, prioritize, and help remediate security risks across the company. The role maintains the company’s risk posture for leadership, supports compliance efforts and audits, and partners with teams to reduce risk.

Responsibilities

• Lead security risk assessments across the company — identify, analyze, and prioritize risks across engineering, IT, operations, and business functions
• Maintain a risk register and a clear, current view of Muon's risk posture for leadership
• Partner with teams across the company to drive remediation of identified risks and track them to closure
• Assess the security risk of new tools, vendors, third parties, and architectural or process changes before adoption
• Define and apply a consistent risk framework and methodology — likelihood and impact scoring, risk acceptance, and exceptions
• Map risks and controls to compliance requirements such as NIST 800-171 and CMMC, and support audits and assessments
• Report risk trends and metrics to leadership and recommend where to invest to reduce the most risk
• Help teams build risk-aware processes and take ownership of the risks they hold

Skills

• 5+ years in information security, security engineering, or security risk/GRC roles
• Hands-on experience running security risk assessments and managing a risk register
• Strong understanding of security risk frameworks and methodologies (e.g., NIST RMF / 800-30, FAIR, or similar)
• Familiarity with compliance frameworks such as NIST 800-171, CMMC, SOC 2, or ISO 27001
• Excellent written and verbal communication skills — able to convey risk and priorities to both engineers and leadership
• Applicant must either be (A) a U.S. person, defined as a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (green card holder), (iii) refugee under 8 U.S.C. § 1157, or (iv) asylee under 8 U.S.C. § 1158, (B) eligible to access the export controlled information without a required export authorization, or (C) eligible and reasonably likely to obtain the required export authorization from the applicable U.S. government agency
• Relevant certifications (CISSP, CRISC, CISA, or similar)
• Background in environments subject to ITAR/EAR export control requirements

Benefits

• Fully on-site at the San Jose office, hybrid, or fully remote from an approved U.S. location
• Competitive equity grant
• Equity compensation for full-time employees
• Medical, dental, and vision insurance
• 401k retirement plan
• Short & long term disability and life insurance
• Three weeks paid vacation for new employees
• 12 paid holidays
• Unlimited sick time
• Paid parental leave

Company Overview