Technical Manager, Information Security

Employer description

Atomic Machines is building the Matter Compiler™, the first in a new class of AI-native, all-digital manufacturing systems that build working machines directly from code. The Matter Compiler  (MC) is aimed at micro-machines: motors and gears the size of a grain of sand, robots small enough to work inside the body, cooling built directly into the chips that run AI, and the many devices like them that have been waiting on a way to build them. Its first product is PrimeSwitch™, an electromechanical power relay the size of a button battery that carries 150 amps continuous current and opens in 50 microseconds, about a thousand times faster than a conventional contactor. Founded by Jeff Holden — serial entrepreneur, ex-Amazon SVP and Uber’s first Chief Product Officer — the company has raised $250 million to date.

Atomic Machines is based in the San Francisco Bay Area, with offices in Emeryville and Santa Clara.

About The Role:

This is a broad-responsibility, high-judgment individual contributor role within the IT team. The Technical Manager, Cybersecurity Engineering is a hands-on leadership role responsible for managing the full lifecycle of enterprise cybersecurity tools, technologies, and detection capabilities across a complex hi-tech manufacturing environment. This role bridges strategic security direction with day-to-day technical execution — managing an external team of engineers and security vendors to deliver consistent, scalable protection across cloud, Operational Technology(OT)/Industrial Control Systems(ICS), endpoint, identity, and network domains.

The successful candidate will own the detection and response program at a management level, drive AWS security best practices across cloud infrastructure, set technical direction for SIEM and cloud-native security platforms, and embed security into the organization's cloud design, Identity and Access Management (IAM) strategy, and network architecture. This is a critical escalation point for complex incidents and a key voice in shaping security policy, standards, and vendor partnerships.

This is a full-time position based in either our Emeryville or Santa Clara office, with occasional work from the other office as needed.

What You’ll Do:

• Day-to-Day
• Advance the detection and response program at a strategic level, leading coverage across Cloud, SaaS, Endpoint, and Identity domains.
• Implement organization-wide automation approaches that reduce alert fatigue and accelerate response across all security tooling.
• Continuously mature SIEM and cloud-native logging architectures, ensuring a highly functional, cost-aware telemetry pipeline spanning corporate, manufacturing, and engineering environments.
• Define and implement scalable security controls that strengthen cloud and infrastructure security through detection, configuration standards, and automated enforcement.
• Drive long-term improvements to cloud and infrastructure security posture through measurable, repeatable, and auditable security processes.
• Ensure 24/7 network operational coverage through on-call rotation and escalation protocols.
• Security Tool Management
• Own end-to-end lifecycle management of the enterprise security toolset including, deployment, configuration, tuning, and decommissioning.
• SIEM platforms, Endpoint Detection and Response (EDR)/Extended Detection and Response (XDR) tools, vulnerability scanners
• Network Traffic Visibility solutions
• Manage SIEM operations including data source onboarding, log normalization, correlation rule development, and alert tuning to minimize noise and maximize fidelity.
• Develop and enforce network device hardening standards across all managed security platforms.
• Team Leadership and Vendor Management
• Lead, mentor, and develop internal technical resources and external security vendors, holding all parties accountable to defined SLAs, quality standards, and security outcomes.
• Serve as the primary escalation point for internal team members and external vendor partners during incidents, complex technical issues, and project delivery challenges.
• Partner with managed security service providers (MSSPs) and specialized security vendors to extend team capabilities, conducting regular performance reviews and contract evaluations.
• Influence and mentor engineers across cross-functional teams, raising the overall bar for detection engineering, automation, and cloud security practices.
• Interface with IT leadership, security management, and vendors to develop and implement new solutions that meet evolving business and regulatory requirements.
• Cloud Security and Posture
• Define and enforce cloud security best practices across all cloud workloads, accounts, and organizational units, including IAM least-privilege, resource policy governance, and guardrail enforcement via SCPs.
• Lead implementation and continuous tuning of cloud security services.
• Partner with cloud infrastructure and platform engineering teams to embed security controls into CI/CD pipelines, infrastructure-as-code (IaC) templates, and cloud “landing zone” designs.
• Design and maintain cloud network security architecture including VPC segmentation, security group standards, PrivateLink, WAF rulesets, and configurations.
• Define cloud security configuration standards (CIS Benchmarks, Security Best Practices) and implement automated compliance enforcement via controls.
• Govern IAM strategy across cloud environments, enforcing role-based access, MFA requirements, and service control policies.
• Network Security
• Participate in the design and enforcement of network security policies, including firewall rule management, zero-trust network access (ZTNA), network access control (NAC), and micro-segmentation.
• Oversee network vulnerability assessments and penetration test scoping; ensure timely remediation and deliver clear risk assessment reports to stakeholders.
• Support compliance activities (e.g., NIST, SOC 2, ISO 27001, etc.) through network controls documentation, audit evidence, and remediation execution.
• Create management processes to keep all network equipment current and hardened against known vulnerabilities.
• Threat Detection and Incident Response
• Manage the technical direction for threat detection and response capabilities across SIEM, cloud-native security platforms, and adjacent security tooling.
• Lead threat-model–driven detection strategy, identifying high-risk attack paths and ensuring detection coverage across cloud, SaaS, endpoint, and identity domains.
• Serve as a senior escalation point during complex security incidents, driving technical analysis, coordinating response across teams, and guiding post-incident remediation.
• Identify systemic gaps in detection coverage, telemetry ingestion, and automation logic; lead cross-team efforts to close gaps at scale.
• Implement and mature playbooks that reduce mean time to detect (MTTD) and mean time to respond (MTTR) across the security operations function.
• Analyze network traffic, system logs, and cloud telemetry to identify anomalies, confirm threats, and support security controls validation.
• OT/ICS and Manufacturing Security
• Conduct operational technology (OT) cybersecurity assessments, identifying risks, potential impacts, and prioritized remediation recommendations.
• Design and support implementation of network segmentation strategies for OT/IT convergence environments, including segmented Industrial Control System networks.
• Collaborate with internal engineering and operations teams to assess security posture without disrupting production operations.
• Identify and implement appropriate remote and local access controls for manufacturing systems.
• Architecture and Engineering Standards
• Own, develop, and maintain architectural standards including reference architectures, data flow diagrams, detection pipeline operating models, and security design patterns.
• Design cybersecurity solutions supporting network segmentation, remote and local access controls, and advanced intrusion detection/prevention systems.
• Partner with IT infrastructure, platform, and engineering teams to ensure security is embedded into cloud design, IAM strategy, and network architecture from inception.
• Drive long-term improvements to cloud and infrastructure security posture through scalable detection, configuration standards, and automation.
• Fulfill project requests to support management and mitigation of vulnerabilities across the enterprise environment.
• Policy, Compliance and Governance
• Develop, maintain, and communicate security policies, plans, and procedures in alignment with applicable regulatory requirements (NIST, SOC 2, ISO 27001, as applicable).
• Provide administrative-level technical oversight across network security operations, ensuring audit-readiness and evidence collection for compliance assessments.
• Produce clear, stakeholder-ready risk articulations for identified vulnerabilities and architectural weaknesses, including impact assessments and recommended mitigations.

What You’ll Need:

• Bachelor's degree in Cybersecurity, Computer Science, Information Systems, or related technical field. Equivalent combination of education and experience considered.
• 8+ years of progressive cybersecurity engineering experience, with at least 2–3 years in a technical lead or people management capacity.
• Demonstrated experience managing both internal security engineers and external vendors/MSSPs, with accountability for security outcomes and SLA adherence.
• Hands-on expertise with enterprise SIEM platforms (Splunk, Sentinel, Chronicle, or equivalent) including detection rule authoring, data onboarding, and operational tuning.
• Deep working knowledge of AWS security services: Security Hub, GuardDuty, CloudTrail, Config, IAM, Macie, Inspector, VPC security architecture, and SCPs.
• Experience conducting OT/ICS cybersecurity assessments in manufacturing, industrial, or critical infrastructure environments is strongly preferred.
• Familiarity with threat modeling frameworks (MITRE ATT&CK, STRIDE) and their application to cloud and OT environments.
• Experience developing security automation using SOAR platforms (Palo Alto XSOAR, Splunk SOAR, Tines, or equivalent) and scripting (Python, PowerShell).
• CISSP or CISM, AWS Certification, CompTIA Security+, GIAC, GCIA, GCIH, Palo Alto PCNSE or Splunk Certified Architect, etc

Technical Skills:

• SIEM / Detection: Splunk ES, Microsoft Sentinel, Rapid 7, Palo Alto – rule authoring, data onboarding, correlation tuning
• AWS Security: Security Hub, GuardDuty, CloudTrail, Config, Macie, Inspector, WAF, IAM, SCPs, VPC security architecture, AWS Organizations
• Security Tools: Firewalls, IDS/IPS, SIEM (Rapid7/Splunk/Palo Alto), NAC (Cisco ISE/Aruba ClearPass), Vulnerability Scanners
• Cloud IAM: AWS IAM, Okta, Azure AD/Entra ID, PAM (CyberArk/BeyondTrust) – identity governance and least privilege
• OT/ICS Security: Dragos, Claroty, or Nozomi – OT visibility; Purdue model, IEC 62443, NERC CIP awareness

The compensation for this position also includes equity and benefits.

Atomic Machines is an equal opportunity employer that values diversity and does not discriminate based on characteristics protected by applicable law. We are committed to an inclusive interview experience, including for individuals with disabilities. To request an accommodation, contact [email protected]. To help our recruiting team manage application volume and respond to candidates more efficiently, Atomic Machines may use AI-assisted tools.