Security & IT Operations Engineer

Prefect

19h•$149,000 - $219,000•Remote

About The Position

Prefect is hiring a Security & IT Operations Engineer to combine and improve the security compliance and corporate IT systems of Prefect and Dagster. The role owns the day-to-day operation of the security compliance program and corporate IT, helping establish a unified setup that runs reliably and becomes easier to manage over time. The position reports to the Security & Systems Lead and is the first hire on the new team. The engineer will maintain SOC 2 controls and evidence, coordinate with auditors and control owners, and help consolidate the two companies’ compliance programs. They will operate corporate IT systems, administer Google Workspace and SaaS applications, support onboarding and offboarding, manage Macs in Rippling, and help employees with laptop and access issues. The role also involves improving access-management processes, protecting corporate systems through updates and vulnerability remediation, and participating in corporate incident response. The role combines hands-on support with longer-term process and systems improvements. It includes automating recurring IT and compliance work using scripts, APIs, workflow tools, or AI. As the Security & Systems function develops, the role may grow toward broader security operations and engineering, risk management, or AI governance, with the direction shaped by the employee’s strengths and the company’s needs. Prefect is a remote-first company with a flexible-first culture. The position is based in the United States, with stated salary ranges varying by metro area. Equity and benefits are separate from the listed base salary ranges.

Requirements

Hands-on IT and compliance experience, with practical technical judgment and ability to take ownership across both areas.
Experience owning recurring SOC 2 activities and working directly with external auditors, or auditing experience.
Understanding of how controls work, what evidence demonstrates their operation, and how controls can be adapted across systems and teams.
Experience administering and securing corporate IT systems, including account management, onboarding and offboarding, and Macs managed through an MDM.
Comfort with patching, endpoint alerts, remediation tracking, phishing or suspicious account activity, and employee troubleshooting.
Ability to automate recurring tasks using scripts, APIs, workflow tools, or AI, and explain an example of something built.
Ability to drive work across teams by establishing owners and deadlines, resolving blockers, following through, documenting work, and escalating when appropriate.
Willingness to provide hands-on laptop and access support as part of the role.
Comfort working in an environment where two companies’ systems are still being consolidated and processes are still being established.

Nice To Haves

Experience with Google Workspace, Rippling, or a GRC platform such as Vanta, Drata, or Thoropass.
Familiarity with SSO, SCIM provisioning, or other ways to automate account access.
Experience implementing or migrating an IT or compliance system, or improving a process involving several teams.

Responsibilities

Run recurring SOC 2 activities, including maintaining controls, collecting evidence, coordinating access reviews, and tracking policy acknowledgments and training.
Work directly with auditors and control owners, and track audit findings through resolution.
Help consolidate the companies’ compliance programs by selecting and setting up a GRC platform with the team lead and consultant.
Adapt control descriptions across environments and design compliance activities that minimize manual work.
Administer corporate IT, including Google Workspace and SaaS applications.
Coordinate employee onboarding and offboarding with People Operations.
Manage the Mac fleet in Rippling and assist employees with laptop and access issues.
Improve and document access-request, approval, provisioning, and removal processes in collaboration with the identity partner.
Manage macOS and application updates, investigate endpoint alerts, track vulnerabilities through remediation, and verify fixes.
Participate in phishing and other corporate incident response with the team lead.
Automate repetitive IT and compliance tasks using scripts, APIs, workflow tools, or AI, and make common requests self-service where possible.
Establish owners and deadlines across teams, work through blockers, and ensure work is completed and documented.
Help shape the combined company’s Security & Systems function and potentially take on broader security operations, engineering, risk management, AI governance, program ownership, and planning.