Senior Security Engineer - Cloud

Muon Space is hiring a Senior Security Engineer to advance security across its infrastructure, data, and people, with a core focus on cloud security. The role leads cloud security posture management, secure architecture and workload protection, and supports compliance with CMMC Level 2 and NIST SP 800-171.

Responsibilities:

• Drive cloud security posture management (CSPM) across AWS, GCP, and Azure environments, including IAM policies, S3/bucket security, security group and network reviews, and CloudTrail/GuardDuty/Config monitoring
• Architect secure, scalable cloud environments — landing zones, account and organization structure, network segmentation, encryption, and key management
• Secure cloud workloads and containers, including Kubernetes/EKS, serverless functions, and container image scanning
• Embed security into infrastructure-as-code and CI/CD pipelines (Terraform, CloudFormation) with automated policy and misconfiguration checks
• Manage cloud identity and access — least-privilege roles, federation, and secrets management across cloud platforms
• Support CMMC Level 2 and NIST SP 800-171 compliance — maintain SSP control narratives, collect evidence, and prepare for assessments
• Contribute to security policy development and keep documentation current as the environment evolves

Requirements:

• 5+ years of experience in information security or security engineering roles
• Deep, hands-on cloud security experience across AWS and at least one of GCP or Azure (IAM, VPC/networking, security groups, CloudTrail, GuardDuty, Config, and KMS)
• Experience with cloud security posture management (CSPM) tooling and securing infrastructure-as-code and CI/CD pipelines
• Familiarity with container and workload security (Kubernetes, serverless, image scanning)
• Experience with SIEM platforms (Splunk, Sentinel, Elastic, or similar) for log analysis and detection engineering
• Solid cloud networking knowledge — firewalls, proxies, DNS security, network segmentation, packet analysis
• Familiarity with compliance frameworks such as NIST 800-171, CMMC, SOC 2, or ISO 27001
• Excellent written and verbal communication skills — able to convey risk and technical findings to both engineers and leadership
• applicant must either be (A) a U.S. person, defined as a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (green card holder), (iii) refugee under 8 U.S.C. § 1157, or (iv) asylee under 8 U.S.C. § 1158, (B) eligible to access the export controlled information without a required export authorization, or (C) eligible and reasonably likely to obtain the required export authorization from the applicable U.S. government agency
• Relevant cloud security certifications (AWS Security Specialty, GCP Professional Cloud Security Engineer, Azure Security Engineer) or general security certifications (CISSP, GIAC, or similar)
• Experience with infrastructure-as-code security (Terraform, CloudFormation) and CI/CD pipeline security
• Background in environments subject to ITAR/EAR export control requirements