Cybersecurity & IT Engineer

Compound Eye is building a secure engineering environment that supports how teams develop, test, and operate. As the hands-on Cybersecurity & IT Engineer (hybrid, Redwood City), you will take ownership of identity, endpoint, network, and security practices for the engineering team, including internal standards aligned to NIST 800-171 and support for a CMMC 2.0 Level 2 environment.

This role is designed for someone who can operate independently, translate security requirements into practical guidance engineers will use, and maintain the day-to-day controls and evidence needed by an external compliance contractor.

Key Responsibilities

• Develop internal security standards based on NIST 800-171, including hardening guides, onboarding and offboarding workflows, access reviews, and incident response runbooks.
• Run recurring access, logs, and configuration audits, and maintain evidence for the compliance contractor.
• Own identity and access across Entra ID, Intune, and Microsoft 365 (including Defender and Purview in GCC High), as well as Google Workspace.
• Own email authentication and DNS for a production domain, including SPF, DKIM, DMARC, and MTA-STS; manage zones and certificates via Cloudflare.
• Secure engineer and lab access using Cloudflare Tunnel / Zero Trust Mesh, VPN jump hosts, and SSH certificate authorities.
• Manage a multi-platform device fleet (Windows, macOS, Linux, Android, iOS) and support the physical network, including firewalls, switches, VLANs, and lab isolation.
• Define AI tooling guardrails for Claude Code and other agentic workflows.
• Keep documentation current and manage vendor relationships within budget.
• Handle hardware logistics from the Redwood City office, including shipping, returns, and spare equipment storage.

Requirements

• 5+ years in IT, systems administration, or security engineering, including experience owning broad-scope work on a small team.
• Hands-on administration of both Microsoft 365 and Google Workspace.
• Strong Linux administration, plus working competence with Windows and macOS.
• Hands-on networking experience with firewalls, VPNs, managed switches, VLANs, and routing.
• Practical experience with zero-trust or overlay networking, such as Cloudflare Tunnel, WireGuard, Tailscale, or similar.
• Ownership experience for DNS and email authentication for a production domain.
• Familiarity with NIST 800-171 and CMMC 2.0 sufficient to avoid creating compliance debt; no certification is required.
• A track record of writing security practices engineers actually adopt.
• Comfort working independently while partnering closely with engineering teams without close oversight.

Technologies

• Entra ID, Intune, Microsoft 365, Defender, Purview, GCC High
• Google Workspace, SPF, DKIM, DMARC, MTA-STS
• Cloudflare, Cloudflare Tunnel, Zero Trust Mesh, VPN jump hosts
• SSH certificate authorities, Windows, macOS, Linux, Android, iOS
• Firewalls, switches, VLANs, Claude Code, WireGuard, Tailscale
• NIST 800-171, CMMC 2.0

Compensation and Location

• Location: Redwood City, CA (hybrid)
• Salary: USD 150,000 - 185,000 per year

Benefits

• Strong Incentive Stock Options (ISO)
• Medical, dental, and vision insurance
• Annual home office stipend
• Employer-paid long-term disability, short-term disability, and life insurance
• 401(k) with employer match after 6 months
• Flexible PTO and 8 holidays + 2 week winter break
• Paid family leave
• Quarterly onsites in San Francisco

Work Environment

• Primarily hybrid from the Redwood City, CA office: typically 1–3 days per week on-site, with more days during build-outs and quarterly company on-sites.
• Less than 10% domestic travel, occasional and infrequent.
• Ability to lift and carry equipment up to 40 lbs, and do occasional on-site physical work (cabling, racking); reasonable accommodations available upon request.

Equal Opportunity / ITAR

• This position requires access to technology controlled under the International Traffic in Arms Regulations (ITAR).
• Applicants must be a U.S. person as defined under ITAR (U.S. citizen, lawful permanent resident, asylee, or refugee) or qualify for a license exception.