IT Systems & Security Engineer

Periodic Labs • Menlo Park, CA

20h

About The Position

You will lead, design, build, and operate Periodic Labs’ Security and IT. You’ll own identity, endpoint, network, and SaaS security. You'll implement smooth, secure internal workflows and keep our researchers productive. You’ll write automation, integrate systems, and set high standards for security, reliability, and user experience. You’ll work closely with research, infra, and operations to ensure our environments including laptops, clusters, and science labs are secure, compliant, and fast. You might thrive in this role if you have experience with: Identity and SSO: Okta or Entra, SAML/OIDC/SCIM, robust RBAC and lifecycle automation Managing Endpoints at Scale: End-to-end ownership of macOS/Windows/Linux device lifecycle. Procurement, zero-touch provisioning, deploy and operate MDM, configuration baselines, inventory, and secure deprovisioning. Installing and operating Security on Devices: Deploy and maintain EDR (CrowdStrike / SentinelOne), full-disk encryption (FileVault/BitLocker), host firewall policies, USB/media controls, kernel/system extension approvals, and app allow/deny lists. Automating Everything: Use IaC and scripting (Terraform/Terragrunt, Ansible, Python/Bash) to codify policy, create self-service workflows, build CLI tooling Managing Clouds: Managing IAM and integrating systems and users in cloud environments such as AWS, GCP, or Azure SaaS and Directory Hygiene: Administer Google Workspace, Slack, GitHub, and other core tools. Define groups, workflows, and guardrails to minimize permissions sprawl Secrets management: Managing KMS, GitHub, 1Password, k8s secrets Zero-Trust and Networking: Implementing identity-aware access, secure Wi-Fi, DNS/certificates, and segmented networks.

Requirements

• Identity and SSO: Okta or Entra, SAML/OIDC/SCIM, robust RBAC and lifecycle automation
• Managing Endpoints at Scale: End-to-end ownership of macOS/Windows/Linux device lifecycle. Procurement, zero-touch provisioning, deploy and operate MDM, configuration baselines, inventory, and secure deprovisioning.
• Installing and operating Security on Devices: Deploy and maintain EDR (CrowdStrike / SentinelOne), full-disk encryption (FileVault/BitLocker), host firewall policies, USB/media controls, kernel/system extension approvals, and app allow/deny lists.
• Automating Everything: Use IaC and scripting (Terraform/Terragrunt, Ansible, Python/Bash) to codify policy, create self-service workflows, build CLI tooling
• Managing Clouds: Managing IAM and integrating systems and users in cloud environments such as AWS, GCP, or Azure
• SaaS and Directory Hygiene: Administer Google Workspace, Slack, GitHub, and other core tools. Define groups, workflows, and guardrails to minimize permissions sprawl
• Secrets management: Managing KMS, GitHub, 1Password, k8s secrets
• Zero-Trust and Networking: Implementing identity-aware access, secure Wi-Fi, DNS/certificates, and segmented networks.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed