IT Security Engineer

This is a fully remote position, open to applicants in North America.

📋 Description

• Take ownership of security standards and controls that safeguard workforce identities, endpoints, and essential business systems.

• Uphold security standards, evaluate control effectiveness, and collaborate with IT on device operations and management.

• Establish and maintain SSO and conditional access standards for cloud, SaaS, and internal systems.

• Manage phishing-resistant MFA standards and their enforcement.

• Oversee privileged access standards, approval policies, and conduct periodic access reviews.

• Collaborate with IT and People teams to ensure timely, thorough, and auditable access changes for joiners, movers, and leavers.

• Direct endpoint detection and response policies and their tuning.

• Ensure device posture and secure network access requirements are maintained.

• Assess identity and endpoint controls and address any identified gaps.

• Work alongside Security Operations on detection and response playbooks.

• Maintain security baselines for administrator access on critical SaaS platforms and vendor accounts.

• Evaluate the impact of vendor security incidents on identity and accounts.

• Manage email authentication standards and configurations for email security.

• Safeguard company domain security and monitor for lookalike domains.

• Address reported phishing incidents and coordinate takedowns.

• Lead security incident responses related to identity, endpoint, and email, including account containment.

• Participate in the Security Operations on-call rotation following onboarding and cross-training.

• Provide guidance on security requirements to IT and employees.

• Report to the Enterprise Security Architect and collaborate with IT, DevOps, Engineering, GRC, and the broader Security team.

⛳️ Requirements

• Passionate about Alpaca's mission and the initiatives we are developing.

• A minimum of 3 years of experience in IT security, identity security, or security engineering roles.

• Practical experience with an identity provider and SSO, including SAML and OIDC.

• Proven track record in enforcing phishing-resistant MFA, such as FIDO2 or hardware security keys.

• Hands-on experience with an endpoint detection and response platform.

• Proficiency in scripting or automation (Python, Bash, or PowerShell).

• Familiarity with zero-trust network access or device posture controls.

• Working knowledge of email authentication (SPF, DKIM, DMARC) and phishing response strategies.

• Experience collaborating closely with IT teams to translate security requirements into operational processes.

• Background in investigating identity, endpoint, or email security alerts.

• Willingness to participate in an on-call rotation.

• Excellent written and verbal communication skills, particularly during incidents.

• Ability to work cross-functionally and manage escalations with composure and decisiveness.

• Experience securing financial, trading, or other highly regulated environments.

• Familiarity with compliance frameworks such as SOC 2 or ISO 27001.

• Experience with just-in-time privileged access solutions.

• Background in securing administrator access to SaaS platforms.

• Proficient with password management and secrets management at scale within a company.

• Experience with MDM platforms for macOS and Windows.

• Familiarity with cloud IAM in AWS, GCP, or Azure.

• Ability to balance security rigor with operational efficiency and the needs of the business.

🏝️ Benefits

• Competitive Salary & Stock Options.

• Health Benefits.

• New Hire Home-Office Setup: One-time USD $500.

• Monthly Stipend: USD $150 per month via a Brex Card.