Senior Security Engineer - General

Muon Space•San Jose, CA

5d•$193,000 - $218,000•Hybrid

About The Position

Muon seeks a Senior Security Engineer to join its Security Engineering & IT team. The role independently advances security across endpoints, networks, cloud environments, and identity systems, protecting Muon’s infrastructure, data, and people while contributing to compliance efforts including NIST 800-171 and ITAR/EAR requirements. The position is hybrid, requiring on-site work in the San Jose, California office three days per week, or can be performed fully remotely from an approved U.S. location. The engineer will manage endpoint and network security, vulnerability management, identity and access systems, security monitoring, and AWS cloud security. The role also supports CMMC Level 2 and NIST SP 800-171 compliance, security awareness, incident response, data loss prevention, and security policy and documentation. The position requires access to export-controlled information and is subject to applicable U.S. Government export regulations. Muon Space designs, builds, and operates low Earth orbit satellite constellations that deliver mission-critical data. The company describes its work as supporting applications from climate monitoring to national security.

Requirements

5+ years of experience in information security or security engineering roles.
Hands-on experience with endpoint detection and response platforms such as CrowdStrike, SentinelOne, or similar.
Experience managing enterprise vulnerability scanning tools such as Tenable, Qualys, Rapid7, or similar.
Deep understanding of identity and access management principles and hands-on Okta or Azure AD administration.
Proficiency with AWS cloud security, including IAM, VPC, Security Groups, CloudTrail, GuardDuty, and Config.
Experience with SIEM platforms such as Splunk, Sentinel, Elastic, or similar for log analysis and detection engineering.
Solid networking knowledge, including firewalls, proxies, DNS security, network segmentation, and packet analysis.
Familiarity with compliance frameworks such as NIST 800-171, CMMC, SOC 2, or ISO 27001.
Excellent written and verbal communication skills, with the ability to convey risk and technical findings to engineers and leadership.
Must meet the stated eligibility requirements for access to export-controlled information: be a U.S. person, be eligible to access the information without required export authorization, or be eligible and reasonably likely to obtain the required authorization. The company may decline to pursue an export licensing process for legitimate business reasons.

Nice To Haves

Relevant certifications such as CISSP, GIAC, CEH, AWS Security Specialty, or similar.
Experience with infrastructure-as-code security, including Terraform or CloudFormation, and CI/CD pipeline security.
Background in environments subject to ITAR/EAR export control requirements.

Responsibilities

Design, deploy, and manage endpoint security solutions across macOS and Windows fleets, including policy tuning, alert triage, and incident response.
Own network security architecture, including firewall rule management, IDS/IPS tuning, network segmentation, and VPN infrastructure.
Lead vulnerability management by running scans, prioritizing findings, coordinating remediation with engineering teams, and tracking closure metrics.
Administer and harden IAM systems, including Okta and AWS IAM, SSO integrations, conditional access policies, privilege access reviews, and lifecycle automation.
Develop and maintain security monitoring and alerting using SIEM platforms, including detection rules and response playbooks.
Conduct security assessments of new tools, vendors, and architectural changes before deployment.
Drive cloud security posture management across AWS environments, including IAM policies, S3 bucket security, security group reviews, and CloudTrail/GuardDuty monitoring.
Support CMMC Level 2 and NIST SP 800-171 compliance by maintaining SSP control narratives, collecting evidence, and preparing for assessments.
Develop and deliver security awareness training and phishing simulation campaigns.
Lead or support incident response, including containment, forensic analysis, root cause determination, and post-incident reporting.
Maintain and improve DLP controls for CUI and sensitive data.
Contribute to security policy development and keep documentation current as the environment evolves.