ON.energy is building the power infrastructure that makes the AI era possible. As AI demand surges past what the grid and traditional data centers can support, ON.energy provides a new class of power technology proven at gigawatt scale and trusted by the world’s leading cloud and AI companies. Our systems are already deployed across 2.5 GW of hyper-scale campuses, validated by top U.S. national labs, and certified for grid-safe operation by major utilities. With real products in the field, we’re scaling faster than the grid can, transforming power from a bottleneck into a competitive advantage for the companies building the future.

We are looking for a Senior Cybersecurity Engineer to architect and implement technical security controls for our grid-connected energy portfolio. As we scale our operations, we need a hands-on engineer to secure the entire data lifecycle - from the industrial control systems (OT) at the edge, through the cloud telemetry pipeline, to the corporate dashboards.

This is a builder role. You will be responsible for deploying and managing our core security infrastructure - specifically Wazuh and Authentik - to secure our AWS environments and operational field assets. You will work directly with control systems engineers and DevOps teams to build security into our backbone.

Responsibilities will include: 

Cloud & Infrastructure Security

Cloud Architecture: Secure the AWS infrastructure that hosts our energy management platforms. Implement hardening baselines and manage security groups for cloud resources
SIEM & Observability (Wazuh): Architect a centralized and on-prem SIEM deployment to ingest logs from CloudTrail, VPC Flow Logs, and Linux servers. Configure custom decoders to detect threats across both cloud and on-prem environments
Infrastructure as Code (IaC): Review and secure Terraform/CloudFormation scripts. Manage security configurations (including Wazuh agents and Authentik outposts) via Ansible or similar automation tools
IoT/Edge Security: Secure the telemetry pipeline from the edge device (site controller) to the cloud, ensuring encryption (TLS 1.2/1.3) and proper certificate management (PKI) for edge

Identity & Access Management (IAM)

Unified IAM (Authentik): Architect Authentik as the central Identity Provider (IdP), enforcing MFA and SSO across cloud consoles, internal engineering tools, and Grafana dashboards
Least Privilege: Engineer granular IAM roles for cloud resources and service accounts, ensuring that automated services have only the permissions necessary to function

Operational Technology (OT) Security

Network Segmentation: Design and implement IEC 62443-aligned network architectures (Purdue Model), strictly controlling traffic between the IT, Cloud, and OT zones
Vulnerability & Integrity Monitoring: Deploy Wazuh agents on industrial PCs and HMIs to perform File Integrity Monitoring (FIM) and vulnerability scanning without disrupting critical real-time processes
Industrial Protocols: Analyze and secure communications (Modbus, DNP3) to ensure integrity between field assets and control centers

Requirements:

5–8 years of technical cybersecurity experience, with a specific blend of Cloud/Linux Engineering and OT/Industrial exposure
Proven experience working with industrial control systems (ICS), SCADA, or utility/energy infrastructure
Deep expertise in securing Linux-based cloud environments and managing infrastructure via code
Comfortable debugging a failed Wazuh agent on a Linux server or tracing a dropped packet in a cloud VPC
Tailoring flexible open-source tools to fit specific architectural needs rather than relying solely on "black box" commercial vendors

Technical stack proficiency: 

Wazuh: Deep experience deploying managers/agents, writing custom rules/decoders, and tuning FIM/SCA modules for low-noise environments
Authentik: Experience configuring Providers (OIDC, SAML), Outposts, and proxying legacy applications
Cloud Platforms: Proficiency with AWS (GuardDuty, IoT Core, IAM) or Azure (Defender for IoT, Entra ID)

Preferred experience:

Experience with Docker/Kubernetes security in an edge computing context
Knowledge of industrial protocols (Modbus TCP, DNP3, IEC 61850)
Certifications: GICSP, GRID, AWS Certified Security – Specialty

For US-based roles - What you’ll get:

Competitive salary + annual performance-based bonus eligibility
Medical, dental, and vision insurance
401(k) with company match
Paid time off and company holidays

For Mexico-based roles - What you’ll get:

Competitive salary + annual performance bonus eligibility
Christmas Bonus (Aguinaldo): 30 days
Major medical expenses and life insurance
Paid time off and holidays (per local policy)

For all roles:

Professional development and growth opportunities
Opportunity to grow with a mission-driven team shaping the future of clean energy
Equal Opportunity: ON.energy is committed to equal employment opportunity and to maintaining a work environment free of harassment, discrimination, or retaliation.
Accommodations: If you need an accommodation during the application process, email recruitment@onenergystorage.com
Benefits vary by role and location and are subject to change.

Senior Cybersecurity Engineer

Job Details

Tools & Tech

Preferred Certs