Lead Security Engineer

Copia Automation•New York, NY

3d•$172,000 - $215,000•Hybrid

About The Position

Copia Automation builds the version control and change management platform for industrial automation. Our customers are in oil & gas, manufacturing, and critical infrastructure â environments where the code running on PLCs, SCADA systems, and HMIs has direct safety implications. We bring modern software engineering practices to operational technology teams that have been underserved by tooling for decades. Weâre a well-funded startup growing fast, with enterprise customers deploying Copia across hundreds of facilities. Our headquarters is in New York City. Weâre hiring a Lead Security Engineer to mature Copiaâs security engineering program. Youâll work closely with our CISO and report into engineering leadership. This is not a siloed role. Youâll be the person responsible for detection engineering on Monday, IAM architecture on Tuesday, compliance evidence on Wednesday, and incident response whenever itâs needed. We need someone who can context-switch across security domains and knows which problem to prioritize on any given day. You should be comfortable building a security program, not just operating one someone else designed. If youâve been the first or second security engineer at a startup before, you know exactly what this means.

Requirements

7+ years of experience in security engineering, with hands-on work across multiple security domains. Youâve ideally done this at a SaaS company or cloud-native startup where you couldnât hide behind a large team.
Strong detection engineering skills â youâve built and tuned SIEM rules, written detection content, and investigated real alerts, not just monitored dashboards someone else built
Deep understanding of AWS security architecture â IAM, VPC design, multi-account strategies, and native security services
Proficiency with infrastructure-as-code for security â codifying policies, guardrails, and configurations rather than clicking through consoles
Experience with identity and access management architecture â IdP configuration, SSO/OIDC, RBAC design, and access lifecycle automation
Scripting and automation chops in Python, Bash, or PowerShell for security operations, orchestration, and evidence workflows
Clear, direct communication skills â you can explain a risk to an engineer, write a post-incident report for leadership, and answer a customer security questionnaire without corporate fluff

Nice To Haves

Experience with CrowdStrike Falcon (EDR + LogScale/NG-SIEM) or Datadog Security Monitoring
Terraform expertise, including module development and policy-as-code (OPA, Sentinel)
Familiarity with fleet management tools (FleetDM, osquery, Jamf, or Intune)
Exposure to OT/ICS security concepts, industrial control systems, or critical infrastructure environments
Experience with EU regulatory frameworks â NIS2, Cyber Resilience Act, IEC 62443
Background in vulnerability management lifecycle â scanning, triage, remediation tracking, and executive reporting
Experience implementing Zero Trust Network Access (ZTNA) in hybrid cloud/on-prem environments

Responsibilities

Detection Engineering & Incident Response: Build, tune, and maintain detection pipelines and alerting. Run incident investigations and root-cause analysis. Drive toward full visibility and monitoring coverage across cloud and endpoint assets.
Cloud & Infrastructure Security: Secure our AWS environment â IAM policies, network segmentation, container security, secrets management. Codify security guardrails in infrastructure-as-code. Review architecture decisions with engineering for security impact.
Enterprise Identity & Cloud Access: Architect and manage identity infrastructure across cloud and SaaS environments â IdP configuration, SSO/OIDC integration, SCIM provisioning, conditional access policies, and RBAC design. Own the full identity lifecycle from onboarding to offboarding, enforce least-privilege across AWS accounts and SaaS applications, and drive access certification and governance programs.
Security Automation: Automate everything you can â alert triage, access provisioning, evidence collection, vulnerability management workflows. Youâre one person covering a lot of ground; automation is how you scale.