Principal Security Engineer, Operations

K2 Space•Los Angeles, CA

4h•$180,000 - $250,000

About The Position

K2 is seeking a Principal Security Engineer to own detection and response across its corporate environment. The role protects the company from sophisticated adversaries seeking to steal or disrupt technology behind its high-powered satellites. The engineer will run and mature the SIEM, create detections based on adversary tradecraft, investigate alerts, and lead incidents from initial signal through containment, eradication, and lessons learned. The position is hands-on across identity, endpoints, SaaS, networks, and cloud telemetry, with responsibility for closing visibility gaps and improving defenses based on investigation findings. The role also develops response playbooks and automation, conducts threat hunts and adversary emulation, performs host, network, and cloud forensics, and partners across the company on security investigations and control improvements. The engineer participates in an on-call rotation and supports compliance and audit evidence requests. K2 describes itself as a high-growth, Series D-funded satellite company building and mass-producing high-power satellite platforms.

Requirements

10+ years of experience in security operations, detection and response, or incident response, preferably in a fast-paced startup or technology environment.
Hands-on experience administering and tuning a SIEM, including log source onboarding, parsing, and detection rule development.
Demonstrated experience leading security incidents end to end, from detection and scoping through containment, eradication, and post-incident review.
Strong working knowledge of attacker tactics, techniques, and procedures (TTPs), the MITRE ATT&CK framework, and the evidence sources needed to investigate them.
Experience investigating endpoint, identity, network, and cloud telemetry across macOS, Windows, and Linux, including EDR, identity provider, and SaaS audit logs.
Either 2+ years of development experience with a modern programming language used to automate detection, enrichment, and response, in lieu of a degree; or a bachelor's degree in security engineering, cybersecurity, computer science, engineering, math, or another STEM discipline.
Knowledge of operating systems, networking, cloud and SaaS platforms, security best practices, and log analysis at scale.
Comfort working with mission-critical and sensitive systems, with a sense of urgency appropriate to the responsibilities.
Excellent interpersonal skills, attention to detail, and problem-solving skills.

Nice To Haves

Bachelor’s degree or equivalent in computer science or engineering.
Detection and response certifications such as GCIH, GCFA, GCIA, GCDA, or OSCP, or equivalent hands-on experience.
Experience building detection-as-code pipelines, security data lakes, or ETL for security telemetry.
Experience with cloud detection and response in AWS, Azure, or GCP.
Experience with threat intelligence, malware analysis, or reverse engineering.
Experience protecting engineering, manufacturing, OT, or mission and ground segment environments.
Prior experience in a defense, aerospace, or other ITAR-regulated environment.
Security community contributions such as tooling, blog posts, conference talks, or CTFs.

Responsibilities

Own day-to-day detection and response across the corporate environment, from alert triage and investigation through containment and remediation.
Administer and mature the SIEM, including log source onboarding, parsing and normalization, telemetry enrichment, rule tuning, and platform health, retention, and cost.
Write, test, and maintain detection content mapped to MITRE ATT&CK using detection-as-code practices, including version control, peer review, and automated testing.
Act as incident commander for corporate security incidents, coordinate stakeholders, and deliver timelines, root cause analysis, and post-incident follow-through.
Build response playbooks and automation across SOAR, scripting, and vendor APIs to reduce time to detect, triage, and contain.
Proactively threat hunt across endpoint, identity, SaaS, and cloud telemetry using threat intelligence and hypotheses about adversary behavior.
Run adversary emulation and purple team exercises to validate detection coverage and close identified gaps.
Perform host, network, and cloud forensics across macOS, Windows, and Linux to reconstruct attacker activity and scope impact.
Investigate phishing, business email compromise, credential abuse, and insider risk in partnership with IT, HR, and Legal.
Partner with IT and infrastructure teams to harden identity, endpoint, and network controls, including conditional access, EDR policy, MDM baselines, segmentation, and secure remote access, informed by investigation findings.
Translate detection and incident findings into vulnerability management priorities and security architecture improvements.
Participate in an on-call rotation for security escalations, including occasional after-hours and weekend response.
Maintain runbooks, detection documentation, and standard operating procedures, and mentor junior team members on investigation and response tradecraft.
Support compliance and audit efforts by producing monitoring, detection, and incident response evidence as needed.