Cybersecurity Engineer

ALO•San Ramon, CA

2d•$80,000 - $90,000

About The Position

ALO is hiring a hands-on Cybersecurity Engineer to own identity and access management across its cloud environment. The role designs, secures, and automates how people and systems authenticate and what resources they can access, using Microsoft Entra as the identity provider. The engineer builds and hardens controls, writes PowerShell automation, and works with IT, infrastructure, and application teams to make secure access the easiest path. The role covers Entra ID identity controls and governance, security service edge capabilities, automation, and privileged infrastructure access. It also includes maintaining IAM standards and documentation, supporting audits and compliance, and participating in identity incident response and an on-call rotation as needed.

Requirements

At least 4 years of experience in security, identity, or systems engineering, including at least 2 years focused on IAM.
Deep hands-on experience with Microsoft Entra ID, including Conditional Access, MFA, PIM, application integrations, groups and roles, and administrative units.
Hands-on experience administering SWG, CASB, ZTNA, or DLP, including identity-based policy design.
Strong PowerShell skills, including the Microsoft Graph PowerShell SDK, with production automation examples that can be shared.
Solid understanding of SAML, OAuth 2.0, OIDC, SCIM, Kerberos, RBAC, least privilege, and zero trust.
Working knowledge of Active Directory and Azure.
Clear written communication skills and ability to explain access decisions to engineers and non-technical stakeholders.

Responsibilities

Engineer and maintain Entra ID, including Conditional Access, MFA, passwordless authentication, and authentication strength policies.
Operate Privileged Identity Management for just-in-time administrative access and promote least privilege across Entra and Azure roles.
Build and tune joiner-mover-leaver lifecycle processes, group-based access, access reviews, and entitlement packages.
Integrate SaaS and internal applications using SAML, OIDC, and SCIM provisioning; manage app registrations, service principals, and managed identities.
Monitor sign-in and audit logs and respond to identity risks surfaced by Entra ID Protection.
Administer and help roll out SWG, CASB, ZTNA (Private Access), and DLP policies, linking access decisions to Entra identity and group context.
Investigate security service edge policy alerts and tune controls to reduce noise without weakening protection.
Automate identity operations with PowerShell and the Microsoft Graph PowerShell SDK, including provisioning, bulk changes, access reporting, and stale-account cleanup.
Build repeatable, version-controlled scripts and runbooks, such as Azure Automation, with logging, error handling, and least-privilege authentication.
Help manage privileged access to servers, databases, and Kubernetes through PAM, aligning roles with Entra groups and auditing session activity.
Write and maintain IAM standards, runbooks, and architecture documentation.
Support audits and compliance requirements in coordination with Governance, Risk, and Compliance team members.
Participate in identity-related incident response and contribute to an on-call rotation as needed.