Security Engineer

Operating as a virtual power plant, our platform delivers the grid of the future today. Our software coordinates and dispatches actual megawatts across thousands of grid-connected sites within regulated wholesale energy markets, managing real financial settlements for the customers behind them. In this position, you will secure real-time energy dispatches, thousands of integrations, and live telemetry for critical infrastructure where system availability and data integrity directly affect physical power distribution and real people.

In this role, you will manage security holistically and make critical, actionable decisions daily, with the independence to shape the program's evolution. You will design and secure software to safeguard virtual critical energy infrastructure, directly enabling the climate energy transition. Your responsibilities will cover a wide range of challenges: establishing our detection and response capabilities from their foundations, leading end-to-end incident response, transforming vulnerability noise in a large monorepo into actionable insights for engineering teams, and operating on both sides of the AI frontier, utilizing agentic tools to amplify your output while establishing the guardrails the company will adopt.

• Strong grasp of cloud, networking, and security concepts. AWS-native security services (CloudTrail, GuardDuty, Security Hub). IAM, RBAC and least privilege, role assumption and federation, network boundaries (VPCs, security groups), encryption and key management (KMS) 

• Tools & Tech Experience with Infrastructure as Code tools (Terraform), containerization (Docker), and monitoring/observability platforms (Datadog, Prometheus, OTEL). Container orchestration tooling (Hashicorp Nomad Vault,) Kubernetes. 

• Background in static application security testing (SAST) and code-level security reviews, including overseeing AI-assisted analysis across large codebases.

• Proficiency producing and maintaining SBOMs within build pipelines, or designing a vulnerability management program utilizing software composition analysis (SCA) tooling on a monorepo.

• Compliance & Framework Experience: Experience of managing and owning technical security controls within SOC 2, ISO 27001, or comparable regulatory frameworks. This includes implementing automated evidence collection processes and representing your work through audit cycles.

• Comfort with AI and agentic engineering tools. (AI coding agents and assistants such as Claude Code, Copilot, or Cursor) as part of a working method, with judgment about where they help and where they do not.

• Threat Modeling & Architecture. Hands-on experience mapping out attack surfaces and trust boundaries for software infrastructure, integrations, and advanced AI technologies. Ability to effectively translate foundational models like STRIDE or MITRE ATT&CK into robust, deployable controls and real-time alerts.

• Regulatory & Risk Frameworks: Operational understanding of NIST CSF, ISO 27001, HIPAA, or GDPR. Ability to translate technical security controls into specific audit requirements and compliance evidence.

• Professional Certifications: Industry-recognized credentials such as CISSP, GIAC, AWS Certified Security Specialty, or CompTIA Security+.

• Vendor & Supply Chain Risk: Evaluating third-party risk posture, auditing complex OAuth integration scopes, and assessing AI service providers for secure data retention and robust operational security configurations.

• AI Automation & Threat Landscapes: Developing LLM-powered security workflows via API and maintaining awareness of specialized vulnerabilities like prompt injection or those outlined in the OWASP Top 10 for LLMs.

• Enterprise AI Governance: Implementing the control plane for safe AI use, including model allow-lists, data boundary enforcement, and AI gateway management.