IT & Security Lead

Maybell Quantum Industries•Denver, CO

2d•$150,000 - $170,000•Hybrid

About The Position

At Maybell Quantum, we're redefining the future of computing. As a venture-backed quantum hardware innovator experiencing rapid growth, we build the cryogenic infrastructure that quantum computers run on — dilution refrigerators, cryogenic RF wiring, and the related systems used by quantum computing companies, national labs, and research institutions worldwide. Quantum computers will be as transformative to the next 30 years as the internet was to the last 30—and our team is creating the hardware foundation to make this revolution possible. Position Overview We're seeking a hands-on IT & Security Lead to become Maybell's first dedicated security hire and the owner of our security program. This is a high-ownership, high-visibility role with real architectural authority: you will decide how our environment is defended, and you will also be the person who implements it. Security at Maybell is not a paper exercise. We are roughly 100 people (and growing) with the security complexity of a much larger company—multiples countries, a manufacturing floor, cryogenic and RF test labs, GDPR obligations, and engineering systems holding export-controlled technical data. That work currently runs through the executive team. It needs an owner. Your primary focus is cybersecurity: identity and access, endpoint and email defense, vulnerability and patch management, logging and monitoring, incident response, and the access controls that protect controlled technical data across all three sites. You will also provide day-to-day IT troubleshooting and end-user support as needed. You'll partner closely with Operations, Engineering, Trade Compliance, and executive leadership to protect the company's most sensitive technical work without slowing down a manufacturing floor or a test lab.

Requirements

8 + years in IT or security with progressive ownership; you've been the senior or sole technical decision-maker for an environment.
Practical security ownership— you've run patching, access reviews, and at least one real incident end to end.
Deep, current Microsoft 365 and Entra ID security expertise : conditional access, Intune, and Defender in production, not in a lab.
Experience supporting a physical operating environment—manufacturing, labs, or hardware engineering. A background exclusively in software companies is unlikely to prepare you for this.
Willingness to handle IT troubleshooting and end-user support when it's needed, without letting it crowd out the security program.
Comfort being the person who says no to local admin, unmanaged devices, and shadow SaaS— including to senior people.
Comfort operating with autonomy and ambiguity in a fast-moving, resource-constrained environment.
Demonstrated desire to own and build—not just execute someone else's playbook.

Nice To Haves

Exposure to regulated data handling—export controls, ITAR/EAR, CMMC, GDPR, or similar—is a strong plus.
Multi-site or international support experience, ideally including Europe, is a strong plus.
Experience managing an MSP relationship rather than being managed by one is a strong plus.
Network segmentation for OT or lab environments, and CAD/PLM platform experience (SolidWorks PDM, Windchill, or comparable), are strong pluses.
Application and source code security experience — repository access controls, secrets management tooling, and securing CI/CD pipelines (GitHub/GitLab, Azure DevOps, or comparable) — is a strong plus.
Familiarity with physical security and site access controls — badging and access control systems, visitor management, and restricted-area procedures — is a strong plus.
Relevant certifications (CISSP, CISM, SC-200, AZ-500, or comparable) are welcome but not .

Responsibilities

Own and mature Maybell's security baseline across all three sites: endpoint protection, patch and vulnerability management, logging, backup and recovery, and periodic access reviews.
Set the security architecture and technical standards for how our environment is built, and enforce them in practice.
Prepare and maintain the security posture documentation that customers, insurers, and investors will ask for in diligence.
Run security awareness training and phishing simulation, and build a culture where reporting is normal.
Own physical site access security — badging and access control systems, visitor and escort procedures, and restricted-area controls for labs, server rooms, and the manufacturing floor across all three sites.
Track and report on security metrics — coverage, patch latency, incident volume, and access review completion—and use them to prioritize.
Own the security configuration of Microsoft 365 and Entra ID: conditional access, MFA, privileged access, and guest and external sharing governance.
Own Defender and the broader M365 security stack, plus email authentication (SPF, DKIM, DMARC) and mail hygiene.
Use Intune to enforce endpoint security policy across Windows and macOS at three sites.
Own the joiner/mover/leaver process—provisioning, access changes, and offboarding that actually completes .
Serve as first responder for phishing, account compromise, and endpoint incidents, with MSP and external IR support as needed.
Build and maintain incident response runbooks, and run tabletop exercises against them.
Own detection and logging coverage, and triage what those signals surface.
Implement and maintain access controls on export-controlled technical data.
Maintain the experience and certification requirements for personnel who handle export-controlled technical data — confirm that training, certification, and authorization prerequisites are satisfied before access is granted, re-verify on role change, and keep the supporting records.
Secure CAD, PLM, and engineering file infrastructure—in scope for this role, not left to engineering.
Own source code security — repository access and branch protections, secrets management so credentials never live in code, and CI/CD pipeline security including build integrity, dependency risk, and artifact signing.
Design and maintain network segmentation for lab and test instrumentation that cannot be patched or managed conventionally.
Address manufacturing IT risk: shop floor systems, ERP endpoints, and the practical realities of instrument PCs running vendor software with long support tails.
Hold a standing working relationship with Operations and Engineering leadership on manufacturing and lab systems.
Provide day-to-day IT troubleshooting and end-user support as needed.
Support all global locations, including network, procurement, and local vendor coordination.
Own IT vendor and license management—MSP, SaaS portfolio, hardware procurement, and renewals
Push routine support and administration to automation, self-service, and our MSP wherever it can go, so security work stays the priority.