Enterprise Security Engineer

Oxide; United States; Remote; USD 248,000 - 303,000; Full time

Job summary

Oxide is building security as an engineering discipline, not a checkbox exercise. We protect the SaaS stack, build signing infrastructure, and secure operations across endpoints and offices.

As a Security Engineer at Oxide, you’ll own security across the build pipeline, external SaaS providers, and internal services, with a focus on risk reduction and practical controls that still enable fast, reliable delivery.

Qualifications

• Experience in building and operating secure pipelines and systems.
• Proven ability to balance security with usability and business needs.
• Familiarity with compliance and audit processes.

Responsibilities

• Manage the security lifecycle of third-party SaaS providers and access controls.
• Oversee endpoint security for corporate machines and MDM tooling decisions.
• Secure internal services: access control, logging, service hardening, backup and recovery.
• Build automation for evidence gathering and audit readiness.
• Participate in security incident response and post-incident improvements.
• Manage security controls of physical office spaces and keystore operations.
• Design and test backup/recovery solutions and coordinate with auditors.

Skills

Rust

Security engineering

Incident response

Auditing

Job description

Corporate security is often perceived as a department of \"no\", where decisionsare made by pointing out what is wrong, controls are designed to shift blame,and success is measured by checking boxes rather than reducing risk. At Oxide,security is understood to be an engineering discipline. When something is risky,the job is to say \"yes, and here's how\", and the controls weoperate exist regardless of whether a spreadsheet says it should.

We produce a product whose premise is that customers can trust what we ship.The security of our build pipeline, our signing infrastructure, and the systemswe work on every day is critical to customer trust in Oxide. We're looking fora security engineer to own security of how Oxide operates: the SaaS providerswe depend on, the endpoints we work from, the internal services used foroperations, our offices, the signing ceremonies that protect our most sensitivekey material, and building automation to support the security of our operations.

Manage the security lifecycle of third-party SaaS providers: user provisioning,access control, configuration, security review and ongoing tracking forcompliance commitments.

Manage endpoint security for corporate machines, including MDM, help reasonabout where management tooling makes sense and where it doesn't.

Secure and help operate internal corporate services: access control, logforwarding, service hardening, vulnerability management, backup and recovery.

Build automation for compliance evidence gathering, turning audit requestsinto automatic or easily repeatable processes.

Participate in security incident response: triage events, investigations,report writing, and general process improvement.

Manage security controls of physical office spaces.

Support offline keystore operations: planning ceremonies, writing andmaintaining the tooling, take role assignments as needed for ceremonies.

Design backup and recovery solutions and perform periodic recovery testing.

Work directly with auditors and compliance partners and finding the balancebetween workable systems and compliance requirements.

These responsibilities are just a starting place! We're a small company, we don't have rigid roles, and we have a lot to do - we can help you grow whereveryour interests take you.

Believe security's job is to say \"yes, and here's how\", not \"no, and here'swhy\". When something is risky, you respond with actionable recommendations fordoing it safely, rather than focusing on why something wouldn't work.

Are allergic to checkbox security. You care whether controls actually reducerisk, not whether it lets someone claim they weren't responsible when thingsgo wrong. You're willing to own the outcomes of your recommendations, includingthose that don't pan out.

Have an attacker's instincts, ideally sharpened by hands-on offensive work.You ask \"how could someone get around this?\" before asking \"does this satisfythe requirement?\"

Treat compliance as an engineering problem. The compliance controls you manageare only those that you'd want anyway, regardless of compliance requirements.You would rather write tooling for compliance evidence gathering thanperiodically collect screenshots.

Believe in the importance of fully documenting your ideas, and you enjoy readingdocumentation produced by others.

Are eager to own cross-function initiatives across the company, working withvarious teams to design and implement solutions that work for everyone.

Look forward to running the MDM program at Oxide.

Are proficient with Rust programming.

Are comfortable in Unix, Mac and Windows environments.

We are very explicit about our values , and they can be seen in daily life at Oxide, for example:

Our rigor means we enjoy and take pride in the craft of engineering.

Our urgency means that we are not above the judicious short-cut.

Our versatility is reflected in our greatest strength: the breadth of our team.

Our transparency can be seen in our consensus-driven RFD process .

Our responsibility means that we both lead and follow: we have our own domains, but we also help others on their parts.

Our curiosity shows in our insatiable desire to learn - and our empathy in our love of teaching others.

Our humor is a big part of our daily lives: we are inveterate wise-crackers whose video meetings spill into simultaneous text chat.

Working at Oxide

Remote first

Most of our team are based outside of the Bay Area. We do ask that your workday overlaps with Pacific Time for at least four hours.

Our families and lives outside of our jobs are very important to us; our schedules are flexible to reflect and support that.

We offer the best medical PPO, dental, and vision plans we can find and cover 100% of premiums for employees and dependents.

Everyone at Oxide makes $275,000 USD, regardless of location. (Some sales positions have a lower base salary and contain a commission component.)