Security Engineer, Identity and Access Management (IAM)

K2 Space•Los Angeles, CA

23h•$120,000 - $150,000

About The Position

Identity is the perimeter at K2. Every engineer, every ground and mission system, every SaaS tool and automated pipeline depends on the right people and services holding exactly the access they need and nothing more. As a Security Engineer on the Identity & Access Management team, you'll help build and operate the identity platform that governs authentication and authorization across our corporate, engineering, and mission environments. You'll get hands-on with our identity provider, SSO and federation, phishing-resistant MFA, lifecycle automation, and access reviews, working alongside senior identity engineers who will help you grow from executing well-defined work to owning identity problems end to end. This is a role for someone early in their security career who wants real-world impact: every application you onboard to SSO, every shared credential you retire, and every workflow you automate directly supports our ability to move fast, operate confidently, and deliver breakthrough satellite capabilities.

Requirements

1–3 years of experience in identity and access management, security engineering, IT systems administration, or a related technical role (internships and co-ops count)
Hands-on experience with an enterprise identity provider (e.g., Okta, Microsoft Entra ID, Ping, or Google Identity), including SSO, MFA, and user or group administration
Foundational understanding of identity protocols and standards such as SAML, OIDC, OAuth 2.0, SCIM, and LDAP, and a desire to go deep on them
Familiarity with least-privilege and role-based access concepts and why they matter
Scripting experience in a modern language such as Python, PowerShell, or Go, used to automate tasks or integrate systems
Exposure to at least one major cloud provider (AWS, Azure, or GCP) and its IAM model
Bachelor's degree in cyber security, computer science, information systems, engineering, or another STEM discipline; OR equivalent hands-on experience
Comfortable working with mission critical and sensitive systems, with a sense of urgency appropriate to the responsibilities
Strong attention to detail, clear written and verbal communication, and a genuine curiosity about how access systems work and break

Nice To Haves

Entry-level security or identity certifications such as CompTIA Security+, Okta Certified Professional or Administrator, Microsoft SC-300, or equivalent hands-on experience
Experience with infrastructure as code (Terraform, CloudFormation, or CDK)
Experience with secrets management tooling such as HashiCorp Vault or cloud-native secret stores
Exposure to Active Directory, Kerberos, or hybrid on-premise and cloud identity environments
Familiarity with identity threat detection concepts (ITDR) or SIEM tooling
Personal projects, home labs, or CTF participation that demonstrate hands-on interest in identity or security
Prior experience or internship in a defense, aerospace, or other ITAR-regulated environment

Responsibilities

Administer and support the enterprise identity platform, including the identity provider, single sign-on, and directory services across corporate, engineering, and mission environments
Onboard SaaS and internal applications to SSO and automated provisioning using SAML, OIDC, and SCIM, retiring local accounts and shared credentials as you go
Operate and improve identity lifecycle workflows, including joiner, mover, and leaver processes, provisioning and deprovisioning, and access requests
Help drive adoption of phishing-resistant MFA (FIDO2/WebAuthn) and support users through enrollment and rollout
Maintain role-based access groups and entitlements under established least-privilege standards, and flag where access models need to evolve
Support privileged access management operations, including administrator accounts, service accounts, and break-glass credential handling
Assist with secrets management hygiene, including credential rotation for the non-human accounts used by automated pipelines
Help implement and monitor conditional access policies, and escalate anomalies in authentication patterns
Execute access review and certification campaigns and collect the evidence auditors and customers require
Write scripts and contribute to infrastructure as code that automate repetitive identity operations rather than resolving them ticket by ticket
Triage identity-related tickets and incidents, and partner with security operations on investigations involving credential abuse or MFA fatigue attacks
Contribute to identity documentation, runbooks, and standards, and keep them current as the environment changes