IT & Security Engineer

Albedo•Broomfield, CO

3d•$106,529 - $114,555•Onsite

About The Position

Albedo builds and operates satellites in Very Low Earth Orbit. As IT & Security Engineer you own a wide surface alongside our IT and security lead: identity, endpoints, cloud infrastructure, network, detection and response, compliance obligations, and a long tail of SaaS. The team scales by turning process into code, and this role is measured by how much faster the rest of the company moves because of what you build.

Requirements

Six-plus years across IT operations, infrastructure, or security engineering, with at least two where you owned production systems and were accountable when they broke.
A track record of closing loops in domains you did not start out knowing. Given an unfamiliar problem, you take it to a finished, working solution without someone decomposing it for you first. This is the single thing we care most about.
Regularly uses AI tools as essential leverage to accelerate work, improve clarity, and multiply output, and verifies before shipping.
Depth in agentic engineering: agents that take real action against production systems, with the access control, observability, and evaluation needed to trust them, deployed as shared services the whole company can use.
Infrastructure as code is your default.
Owns code in production: Python, TypeScript, Go, or similar, at the level of a service or CLI that other people depend on. Whether you write it yourself or direct a model to write it matters far less than whether you can review it, debug it, and stay on the hook when it breaks.
You build tools for other people, and you care whether anyone actually adopted what you shipped.
Judgment about blast radius. You know which changes are reversible in five minutes, and which ones are silently wrong for a quarter, and you slow down for the second kind.
Linux as a managed platform for real users, not just servers: you have kept engineering workstations or lab machines patched, compliant, and supportable, and you can work out what a misbehaving host is actually doing.
Identity fluency in Entra ID or an equivalent, deep enough to design an access model.
Real ownership of something security-relevant: a detection, an incident, an identity model, an access boundary.
Vulnerability management experience across both infrastructure and application findings.
On-prem network architecture design and implementation
On-site in Broomfield, CO.
In compliance with federal law, all persons hired must verify identity and eligibility to work in the United States and complete the required employment eligibility verification form upon hire. All persons hired will be required to be a U.S. citizen, a lawful permanent resident of the U.S., or a protected individual as defined by 8 U.S.C. 1324b(a)(3), or eligible to obtain the required authorizations from the U.S. Department of State.
Applicants must be a U.S. Person as defined under 22 CFR 120.62

Nice To Haves

Microsoft 365 and Entra ID in GCCH.
A cybersecurity background: SIEM and EDR operations, detection engineering, threat hunting, or incident response.
Exposure to CMMC Level 2, NIST 800-171, or ITAR. Genuinely not required: we will teach the frameworks. The hard part is knowing which technical mechanism actually satisfies a control, and that is learned here.
Intune at fleet scale across macOS, Windows, and Linux.
Having been an early member of a small infrastructure or security team, where you decided your own scope.

Responsibilities

Own the systems the company runs on, measured by whether they work: identity, endpoints, cloud infrastructure, network, detection and response, and the compliance controls underneath them.
Expect to move between unrelated domains in the same day or hour. Breadth is the defining feature of this role, and switching context without losing the thread is the skill that carries you through it.
Build the internal tooling and automation that lets a small team cover a surface that would otherwise require a large one. This is a first-class part of the job, not something you get to when tickets are quiet.
Own infrastructure as code in Terraform across AWS.
Run identity in Entra ID: authentication, conditional access, SSO and SCIM integrations, group and role design, and privileged access.
Manage endpoints in Intune: enrollment, configuration and compliance baselines, and update rings across the fleet.
Operate Microsoft Sentinel and Defender XDR: detection tuning, hunting queries, and triage that closes every incident with a classification you can defend.
Drive our CMMC Level 2, NIST 800-171 (R2 and R3), and ITAR programs. Controls are implemented as code and evidence is produced continuously through our own tooling and Vanta, so that an audit becomes a query against systems we already run.
Triage and remediate vulnerabilities across the infrastructure we run, and drive findings in application code and containers to closure with the software teams that own them.
Own the Linux estate: provisioning, hardening, patching, and bringing it under real configuration management for the first time.
Own the network: DNS, routing, remote access, and the boundary between on-prem infrastructure and cloud.
Keep the logging pipeline everything above feeds healthy, so that detections and audit evidence come from sources we trust.
Respond to incidents, write the postmortem, then fix the class of problem behind it.
Decide what to work on. Nobody hands you a backlog. You find the highest-leverage thing and justify why it was the highest-leverage thing.