IAM Security Engineer: Identity & Access Champion

K2 Space; Los Angeles (CA); On-site; USD 120,000 - 150,000; Full time

Benefits offered by this job

Equity in company

Comprehensive benefits package

Paid time off

Job summary

K2 Space is seeking a Security Engineer to build and operate the identity platform governing authentication and access across corporate, engineering, and mission environments. You will work hands-on with the identity provider, SSO, and MFA, evolving from executing defined tasks to owning identity problems end to end.

The role emphasizes phishing-resistant MFA, lifecycle workflows, and least-privilege access.

Qualifications

• 1-3 years of experience in identity and access management, security engineering, IT systems administration, or a related technical role (internships and co-ops count).
• Hands-on experience with an enterprise identity provider (Okta, Microsoft Entra ID, Ping, or Google Identity), including SSO, MFA, and user or group administration.
• Foundational understanding of identity protocols and standards such as SAML, OIDC, OAuth 2.0, SCIM, and LDAP, and a desire to go deep on them.
• Familiarity with least-privilege and role-based access concepts and why they matter.
• Scripting experience in a modern language such as Python, PowerShell, or Go, used to automate tasks or integrate systems.
• Exposure to at least one major cloud provider (AWS, Azure, or GCP) and its IAM model.
• Comfortable working with mission critical and sensitive systems, with a sense of urgency appropriate to the responsibilities.
• Strong attention to detail, clear written and verbal communication, and a genuine curiosity about how access systems work and break.

Responsibilities

• Administer and support the enterprise identity platform, including the identity provider, single sign-on, and directory services across corporate, engineering, and mission environments.
• Onboard SaaS and internal applications to SSO and automated provisioning using SAML, OIDC, and SCIM, retiring local accounts and shared credentials as you go.
• Operate and improve identity lifecycle workflows, including joiner, mover, and leaver processes, provisioning and deprovisioning, and access requests.
• Help drive adoption of phishing-resistant MFA (FIDO2/WebAuthn) and support users through enrollment and rollout.
• Maintain role-based access groups and entitlements under established least-privilege standards, and flag where access models need to evolve.
• Support privileged access management operations, including administrator accounts, service accounts, and break-glass credential handling.
• Assist with secrets management hygiene, including credential rotation for the non-human accounts used by automated pipelines.
• Help implement and monitor conditional access policies, and elevate anomalies in authentication patterns.
• Execute access review and certification campaigns and collect the evidence auditors and customers require.
• Write scripts and contribute to infrastructure as code that automate repetitive identity operations rather than resolving them ticket by ticket.
• Triage identity-related tickets and incidents, and partner with security operations on investigations involving credential abuse or MFA fatigue attacks.
• Contribute to identity documentation, runbooks, and standards, and keep them current as the environment changes.

Skills

Identity & access management

Okta / Microsoft Entra ID / Ping / GID

SAML / OIDC / OAuth 2.0 / SCIM / LDAP

Least-privilege / RBAC concepts

Python / PowerShell / Go scripting

AWS / Azure / GCP IAM

Attention to detail & communication

Education

Bachelor's degree in cyber security / CS / IS / engineering or STEM, or equivalent

Tools

Terraform / CloudFormation / CDK

HashiCorp Vault

Job description

K2 Space is seeking a Security Engineer to build and operate the identity platform governing authentication and access across corporate, engineering, and mission environments. You will work hands-on with the identity provider, SSO, and MFA, evolving from executing defined tasks to owning identity problems end to end.

The role emphasizes phishing-resistant MFA, lifecycle workflows, and least-privilege access.