Enterprise Security Engineer

Benchling•San Francisco, CA

1d•$189,000 - $256,000•Hybrid

About The Position

As an Enterprise Security Engineer at Benchling you’ll be joining a team responsible for building a best-in-class security program from the ground up. Our focus is on providing value to the organization by emphasizing real world security and embracing automation and AI. We’re looking for engineers who are excited to apply their expertise to our mission of securing some of society's most sensitive data.

Requirements

5+ years in a security engineering or IAM-focused role
Deep, hands-on IdP expertise (preferably Okta) — SSO, SCIM, MFA, Lifecycle Management, and NHI management are all areas you can speak to with depth and demonstrate in practice
Demonstrated experience implementing zero trust architecture in practice — not just familiarity with the framework, but hands-on delivery of continuous verification, device trust integration, and least-privilege enforcement across an organization
Strong working knowledge of identity protocols: SAML, OIDC, OAuth 2.0, and SCIM
Proficiency managing macOS endpoints at scale using Fleet or an equivalent MDM platform
Foundational cloud IAM experience across at least one major provider (AWS, GCP, or Azure) — enough to audit, scope, and remediate identity issues
Demonstrated track record of building automation that eliminated recurring manual work
Scripting proficiency in in at least one language, preferably Python
Excellent communication skills, with the ability to engage effectively with both technical teams and non-technical stakeholders.
Strong understanding of operating systems fundamentals (MacOS/Linux/Windows)

Nice To Haves

Experience with ZTNA platforms (Cloudflare Access, Zscaler Private Access, Tailscale, or similar) and the operational patterns around replacing VPN with identity-aware access
Hands-on use of AI coding assistants (Copilot, Claude, Cursor, or similar) to increase velocity
Experience governing AI/ML service identities or securing LLM API integrations
Familiarity with PAM solutions such as HashiCorp Vault, AWS Secrets Manager, or Okta Privileged Access
Okta Certified Administrator, Okta Certified Consultant, or equivalent certification

Responsibilities

Drive the organization's zero trust strategy end to end — treating identity, device health, network context, and application sensitivity as continuous inputs to access decisions rather than one-time gates
Design and maintain least-privilege access patterns, Just-in-Time (JIT) access, and Privileged Access Management (PAM) controls
Deploy, configure, and maintain MDM infrastructure for the macOS fleet, ensuring device compliance feeds directly into zero trust access policy decisions
Enforce SSO-required policies, review and restrict OAuth scopes, and audit third-party integration access
Build processes and tooling to detect shadow IT, unauthorized OAuth app grants, and SaaS tools that bypass identity controls
Evaluate and deploy AI-native security tooling where it demonstrably reduces analyst burden or closes coverage gaps faster than traditional approaches
Define and enforce security standards for AI agent and LLM service identities — including scoped API keys, short-lived credentials, and workload identity federation
Develop and enforce CIS/NIST-aligned configuration baselines
Meaningfully reduce manual toil through automation and, where applicable, AI-assisted tooling