Principal Security Engineer, Operations

K2 Space•Los Angeles, CA

10d

About The Position

K2 is hiring a Principal Security Engineer to own detection and response for its corporate environment. The role protects K2 from sophisticated adversaries seeking to steal or disrupt technology behind its high-powered satellites. The engineer will operate and mature the SIEM, develop detections based on adversary tradecraft, investigate alerts, and lead incidents from initial signal through containment, eradication, and lessons learned. This is a hands-on role spanning identity, endpoints, SaaS, network, and cloud telemetry, with an emphasis on addressing visibility gaps and responding with urgency. The engineer will also build response playbooks and automation, conduct threat hunts and adversary emulation, perform forensics, and partner with IT and infrastructure teams to improve security controls. The role participates in an on-call rotation, supports compliance and audit requests, maintains operational documentation, and mentors junior team members. The successful candidate will bring substantial security operations or incident response experience, demonstrated SIEM administration and incident leadership skills, familiarity with MITRE ATT&CK and cross-platform telemetry, and either relevant development experience or a qualifying STEM bachelor's degree. The position requires access to information controlled under U.S. export regulations; the person hired must be a U.S. person as defined by the applicable regulation or otherwise eligible for a federally issued export control license.

Requirements

10+ years of experience in security operations, detection and response, or incident response; experience in a fast-paced startup or technology environment is preferred.
Hands-on experience administering and tuning a SIEM, such as Splunk, Microsoft Sentinel, Elastic, Panther, or Chronicle, including log source onboarding, parsing, and detection rule development.
Demonstrated experience leading security incidents end to end, from detection and scoping through containment, eradication, and post-incident review.
Strong working knowledge of attacker tactics, techniques, and procedures, the MITRE ATT&CK framework, and evidence sources needed for investigations.
Experience investigating endpoint, identity, network, and cloud telemetry across macOS, Windows, and Linux, including EDR, identity provider, and SaaS audit logs.
Either 2+ years of development experience with a modern programming language (including but not limited to Python, Go, C++, or Rust) used to automate detection, enrichment, and response, in lieu of a degree; or a bachelor's degree in security engineering, cybersecurity, computer science, engineering, mathematics, or another STEM discipline.
Knowledge of operating systems, networking, cloud and SaaS platforms, security best practices, and log analysis at scale.
Comfort working with mission-critical and sensitive systems, with a sense of urgency appropriate to the responsibilities.
Excellent interpersonal skills, attention to detail, and problem-solving skills.

Nice To Haves

Bachelor's degree or equivalent in computer science or engineering.
Detection and response certifications such as GCIH, GCFA, GCIA, GCDA, or OSCP, or equivalent hands-on experience.
Experience building detection-as-code pipelines, security data lakes, or ETL for security telemetry.
Experience with cloud detection and response in AWS, Azure, or GCP.
Experience with threat intelligence, malware analysis, or reverse engineering.
Experience protecting engineering, manufacturing, OT, or mission and ground segment environments.
Prior experience in a defense, aerospace, or other ITAR-regulated environment.
Security community contributions such as tooling, blog posts, conference talks, or CTFs.

Responsibilities

Own day-to-day detection and response in the corporate environment, from alert triage and investigation through containment and remediation.
Administer and mature the SIEM, including log source onboarding, parsing and normalization, telemetry enrichment, rule tuning, platform health, retention, and cost.
Write, test, and maintain MITRE ATT&CK-mapped detection content using detection-as-code practices, including version control, peer review, and automated testing.
Serve as incident commander for corporate security incidents, coordinating stakeholders and delivering timelines, root cause analysis, and post-incident follow-through.
Build response playbooks and automation using SOAR, scripting, and vendor APIs to reduce time to detect, triage, and contain.
Proactively threat hunt across endpoint, identity, SaaS, and cloud telemetry using threat intelligence and hypotheses about adversary behavior.
Run adversary emulation and purple-team exercises to validate detection coverage and close identified gaps.
Perform host, network, and cloud forensics across macOS, Windows, and Linux to reconstruct attacker activity and scope impact.
Investigate phishing, business email compromise, credential abuse, and insider risk in partnership with IT, HR, and Legal.
Partner with IT and infrastructure teams to harden identity, endpoint, and network controls, including conditional access, EDR policy, MDM baselines, segmentation, and secure remote access.
Translate detection and incident findings into vulnerability management priorities and security architecture improvements.
Participate in an on-call rotation for security escalations, including occasional after-hours and weekend response.
Maintain runbooks, detection documentation, and standard operating procedures, and mentor junior team members on investigation and response tradecraft.
Support compliance and audit efforts by producing monitoring, detection, and incident response evidence as needed.