Lead Security Engineer

About the Role

We're looking for a hands-on Lead Security Engineer to own the full range of security engineering work across MISUMI Americas. You'll secure our infrastructure, run access audits, build and enforce controls, review our systems and code, and help investigate incidents — and you'll have a real voice in the policies and priorities that shape how we handle security company-wide.

A big part of the job is infrastructure: both physical networking and cloud. You'll keep IAM, security groups, permission policies, and application permissions tightly scoped to least privilege. You'll also sit on our cross-departmental threat detection and incident response group, and act as the escalation point when a routine security issue turns into something bigger than the IT team can handle alone.

You'll help decide which security projects matter most across our global operations, run the audits and reviews that back that up, and help shape security policy and standards alongside security leadership. A growing part of the role is AI: you'll manage how our AI tools (including Claude) are configured, decide what new AI capabilities are safe to turn on, and vet integrations — including reviewing new MCP servers — before they go live. You'll also work with Information Security to build and maintain evidence for J-SOX, NIST 800-171, CMMC 2.0, and SOC 2 across a global business.

What You'll Do

Security Decisions & Prioritization

• Act as the hands-on security lead across IT and engineering, and the main point of execution for security work
• Help decide which security projects and initiatives to tackle first across MISUMI Americas' global operations
• Help write, shape, and enforce security policies, standards, and governance alongside security leadership

Incident Response & Escalation

• Serve on our cross-departmental threat detection and incident response team, investigating incidents hands-on and helping coordinate the response
• Act as the escalation point for IT, providing direction, mitigations, or solutions when an issue goes beyond routine
• Dig into root cause on tougher problems and put fixes in place so they don't recur

Infrastructure Security

• Keep infrastructure secure across physical networking and cloud — firewalls, segmentation, wireless, and cloud account/workload configuration
• Design and manage IAM at the infrastructure level: roles, security groups, and permission policies scoped to least privilege
• Review and tighten application permissions and access policies as the environment grows; catch misconfigurations and permission drift early

Identity, Access & User Audits

• Run user access audits and regular access reviews across identity and application layers
• Determine what user groups and roles are needed to manage system access
• Handle access changes as people join, move, and leave, keeping permissions aligned with policy

AI Security

• Manage enterprise AI tools such as Claude, keeping configurations, roles, and access current
• Evaluate new AI capabilities (e.g., Claude for Chrome) and decide whether to enable them and what guardrails they need
• Vet new AI integrations before launch, including automated scans and manual review of any new local MCP server
• Turn AI security decisions into reusable policies and practices

Application & Engineering Security

• Review systems for security issues, including running automated scans
• Vet third-party and open-source components before adoption
• Partner with engineering to build security into how we ship software and infrastructure

Compliance & Audit Support

• Gather and maintain audit evidence for J-SOX, NIST 800-171, CMMC 2.0, and SOC 2
• Run recurring compliance checks and validate controls across our global footprint
• Map controls and evidence to audit requirements and support audits start to finish, with a focus on evidence and remediation

Policy, Process & Automation

• Turn manual security work into documented practices, runbooks, and repeatable processes
• Automate access reviews, monitoring, alerting, and reporting
• Keep security documentation and the internal knowledge base current