IT & Security Engineer

(EDO) Entertainment Data Oracle, Inc.; Broomfield (CO); On-site; USD 107,000 - 115,000; Full time

Job summary

Albedo is building the infrastructure for Very Low Earth Orbit (VLEO) and seeks an IT & Security Engineer who will own identity, endpoints, cloud infrastructure, network, detection, and compliance. The role requires broad domain knowledge and a hands-on, ownership mindset to accelerate the company’s mission from our Broomfield, CO HQ.

You will work across AWS, Entra ID, Intune, and security tooling, turning processes into code and delivering rapid, auditable results that support our fast-moving

Qualifications

• Six-plus years across IT operations, infrastructure, or security engineering.
• Track record of closing loops on unfamiliar problems to a working solution.
• Regularly uses AI tools to accelerate work and verify before shipping.
• Depth in agentic engineering with production-scale tooling.
• Infrastructure as code is your default.
• Owns production code in Python, TypeScript, or Go.
• Builds tools for others and measures adoption.
• Judgment on blast radius and reversibility of changes.
• Linux as a managed platform with patched, compliant hosts.
• Identity fluency in Entra ID or equivalent.
• Ownership of security-relevant assets or processes.
• Vulnerability management across infra and apps.
• On-prem network architecture experience.
• On-site in Broomfield, CO.

Responsibilities

• Own the systems the company runs on: identity, endpoints, cloud, network, detection and response, and controls.
• Move between domains in a day; maintain thread while switching contexts.
• Build internal tooling and automation to cover larger surface with a small team.
• Own infrastructure as code across AWS in Terraform.
• Run identity in Entra ID: authentication, conditional access, SSO, SCIM, groups.
• Manage endpoints in Intune: enrollment, config, and compliance baselines.
• Operate Microsoft Sentinel and Defender XDR: tuning, queries, triage.
• Drive ITAR, NIST 800-171, and CMMC Level 2 programs via code and audits.
• Triage vulnerabilities and drive remediation with software teams.

Skills

IT operations

Security engineering

Production ownership

Infrastructure as code

Python/TypeScript/Go

AI tooling

Tools

Terraform

Entra ID

Intune

Microsoft Sentinel

AWS

Vanta

Job description

Albedo is making Very Low Earth Orbit (VLEO) mainstream, building the infrastructure to enable every satellite mission to enter this new orbital domain. We build buses, integrated satellites, and turnkey missions for customers to thrive in VLEO, below 300 km, where proximity compounds performance and drag self-cleans debris.

As part of the first 100 employees at Albedo, you will have a big impact on Albedo’s trajectory to proliferating VLEO - whether you’re advancing hardware to increase satellite longevity, scaling production for large constellations, building next-gen flight and ground software to push performance, or enabling missions that matter for national security and our day-to-day life here on Earth.

How We Operate: Albedo takes a first-principles approach - in space and in business. We move with speed, take calculated risks, and learn quickly. We use AI regularly to create leverage in every discipline across the company. We work in-person at our Broomfield, CO HQ to maximize team and company productivity. We work hard and with urgency to compound our first-mover advantage.

Who We're Looking For: Builders who want to own outcomes, not tasks. Systems thinkers who balance precision with iteration while thinking about the big picture. Individuals who are energized by creating a category rather than competing in an existing one. You’ll join a team that has already proven what others said wasn’t feasible and is now scaling and upgrading our VLEO buses & payloads to serve mission sets across sensing, communications, and responsive operations.

About This Role:

Albedo builds and operates satellites in Very Low Earth Orbit. As IT & Security Engineer you own a wide surface alongside our IT and security lead: identity, endpoints, cloud infrastructure, network, detection and response, compliance obligations, and a long tail of SaaS. The team scales by turning process into code, and this role is measured by how much faster the rest of the company moves because of what you build.

What You’ll Do:

• Own the systems the company runs on, measured by whether they work: identity, endpoints, cloud infrastructure, network, detection and response, and the compliance controls underneath them.
• Expect to move between unrelated domains in the same day or hour. Breadth is the defining feature of this role, and switching context without losing the thread is the skill that carries you through it.
• Build the internal tooling and automation that lets a small team cover a surface that would otherwise require a large one. This is a first-class part of the job, not something you get to when tickets are quiet.
• Own infrastructure as code in Terraform across AWS.
• Run identity in Entra ID: authentication, conditional access, SSO and SCIM integrations, group and role design, and privileged access.
• Manage endpoints in Intune: enrollment, configuration and compliance baselines, and update rings across the fleet.
• Operate Microsoft Sentinel and Defender XDR: detection tuning, hunting queries, and triage that closes every incident with a classification you can defend.
• Drive our CMMC Level 2, NIST 800-171 (R2 and R3), and ITAR programs. Controls are implemented as code and evidence is produced continuously through our own tooling and Vanta, so that an audit becomes a query against systems we already run.
• Triage and remediate vulnerabilities across the infrastructure we run, and drive findings in application code and containers to closure with the software teams that own them.
• Own the Linux estate: provisioning, hardening, patching, and bringing it under real configuration management for the first time.
• Own the network: DNS, routing, remote access, and the boundary between on-prem infrastructure and cloud.
• Keep the logging pipeline everything above feeds healthy, so that detections and audit evidence come from sources we trust.
• Respond to incidents, write the postmortem, then fix the class of problem behind it.
• Decide what to work on. Nobody hands you a backlog. You find the highest-leverage thing and justify why it was the highest-leverage thing.

Your Ideal Skills and Experience:

• Six-plus years across IT operations, infrastructure, or security engineering, with at least two where you owned production systems and were accountable when they broke.
• A track record of closing loops in domains you did not start out knowing. Given an unfamiliar problem, you take it to a finished, working solution without someone decomposing it for you first. This is the single thing we care most about.
• Regularly uses AI tools as essential leverage to accelerate work, improve clarity, and multiply output, and verifies before shipping.
• Depth in agentic engineering: agents that take real action against production systems, with the access control, observability, and evaluation needed to trust them, deployed as shared services the whole company can use.
• Infrastructure as code is your default.
• Owns code in production: Python, TypeScript, Go, or similar, at the level of a service or CLI that other people depend on. Whether you write it yourself or direct a model to write it matters far less than whether you can review it, debug it, and stay on the hook when it breaks.
• You build tools for other people, and you care whether anyone actually adopted what you shipped.
• Judgment about blast radius. You know which changes are reversible in five minutes, and which ones are silently wrong for a quarter, and you slow down for the second kind.
• Linux as a managed platform for real users, not just servers: you have kept engineering workstations or lab machines patched, compliant, and supportable, and you can work out what a misbehaving host is actually doing.
• Identity fluency in Entra ID or an equivalent, deep enough to design an access model.
• Real ownership of something security-relevant: a detection, an incident, an identity model, an access boundary.
• Vulnerability management experience across both infrastructure and application findings.
• On-prem network architecture design and implementation
• On-site in Broomfield, CO.

Nice to have:

• Microsoft 365 and Entra ID in GCCH.
• A cybersecurity background: SIEM and EDR operations, detection engineering, threat hunting, or incident response.
• Exposure to CMMC Level 2, NIST 800-171, or ITAR. Genuinely not required: we will teach the frameworks. The hard part is knowing which technical mechanism actually satisfies a control, and that is learned here.
• Intune at fleet scale across macOS, Windows, and Linux.
• Having been an early member of a small infrastructure or security team, where you decided your own scope.

Salary Range:

• $106,529 - $114,555 per year

Compensation and Benefits for Full-Time Roles:

• Health Insurance: 100% employee coverage & 75% dependent coverage
• Parental leave and childcare coverage
• Flexible vacation and sick time from day one
• 12 company holidays
• $100 monthly wellness benefit
• Relocation package if not based in Denver

The final compensation package is subject to change if the candidate's experience and company need drive a different job level than originally slated for the position.

Albedo does not accept agency resumes. Please do not forward resumes to Albedo employees. Albedo is not responsible for any fees or overhead related to unsolicited resumes.

AI Disclosure: We may use Artificial Intelligence (AI) technology to support and enhance our recruitment process. This includes recording, transcribing, analyzing, and evaluating your interview responses to ensure accurate, consistent, and efficient assessment of job-related skills, knowledge, and abilities. While AI tools may assist in this process, our human recruiting and hiring teams make all hiring decisions. For questions about AI use in interviews, data handling, or to request accommodations, contact [e-mail]

Additional Requirements:In compliance with federal law, all persons hired must verify identity and eligibility to work in the United States and complete the required employment eligibility verification form upon hire. All persons hired will be required to be a U.S. citizen, a lawful permanent resident of the U.S., or a protected individual as defined by 8 U.S.C. 1324b(a)(3), or eligible to obtain the required authorizations from the U.S. Department of State.

Equal Opportunity Employer/Veterans/Disabled:Albedo is an equal opportunity employer, and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability status, protected veteran status, or any other characteristic protected by law.

Relocation: Relocation support for this position is available

Applicants must be a U.S. Person as defined under 22 CFR 120.62

#LI-Onsite

Voluntary Self-Identification

For government reporting purposes, we ask candidates to respond to the below self-identification survey.Completion of the form is entirely voluntary. Whatever your decision, it will not be considered in the hiringprocess or thereafter. Any information that you do provide will be recorded and maintained in aconfidential file.

As set forth in Albedo’s Equal Employment Opportunity policy,we do not discriminate on the basis of any protected group status under any applicable law.

If you believe you belong to any of the categories of protected veterans listed below, please indicate by making the appropriate selection.As a government contractor subject to the Vietnam Era Veterans Readjustment Assistance Act (VEVRAA), we request this information in order to measurethe effectiveness of the outreach and positive recruitment efforts we undertake pursuant to VEVRAA. Classification of protected categoriesis as follows:

A "disabled veteran" is one of the following: a veteran of the U.S. military, ground, naval or air service who is entitled to compensation (or who but for the receipt of military retired pay would be entitled to compensation) under laws administered by the Secretary of Veterans Affairs; or a person who was discharged or released from active duty because of a service-connected disability.

A "recently separated veteran" means any veteran during the three-year period beginning on the date of such veteran's discharge or release from active duty in the U.S. military, ground, naval or air service.

An "active duty wartime or campaign badge veteran" means a veteran who served on active duty in the U.S. military, ground, naval or air service during a war, or in a campaign or expedition for which a campaign badge has been authorized under the laws administered by the Department of Defense.

An "Armed forces service medal veteran" means a veteran who, while serving on active duty in the U.S. military, ground, naval or air service, participated in a United States military operation for which an Armed Forces service medal was awarded pursuant to Executive Order 12985.

Select...

Voluntary Self-Identification of Disability

Form CC-305 Page 1 of 1 OMB Control Number 1250-0005 Expires 07/31/2029

Why are you being asked to complete this form?

We are a federal contractor or subcontractor. The law requires us to provide equal employment opportunity to qualified people with disabilities. We have a goal of having at least 7% of our workers as people with disabilities. The law says we must measure our progress towards this goal. To do this, we must ask applicants and employees if they have a disability or have ever had one. People can become disabled, so we need to ask this question at least every five years.

Completing this form is voluntary, and we hope that you will choose to do so. Your answer is confidential. No one who makes hiring decisions will see it. Your decision to complete the form and your answer will not harm you in any way. If you want to learn more about the law or this form, visit the U.S. Department of Labor’s Office of Federal Contract Compliance Programs (OFCCP) website at www.dol.gov/ofccp .

How do you know if you have a disability?

A disability is a condition that substantially limits one or more of your “major life activities.” If you have or have ever had such a condition, you are a person with a disability. Disabilities include, but are not limited to:

• Alcohol or other substance use disorder (not currently using drugs illegally)
• Autoimmune disorder, for example, lupus, fibromyalgia, rheumatoid arthritis, HIV/AIDS
• Blind or low vision
• Cancer (past or present)
• Cardiovascular or heart disease
• Celiac disease
• Cerebral palsy
• Deaf or serious difficulty hearing
• Diabetes
• Disfigurement, for example, disfigurement caused by burns, wounds, accidents, or congenital disorders
• Epilepsy or other seizure disorder
• Gastrointestinal disorders, for example, Crohn's Disease, irritable bowel syndrome
• Intellectual or developmental disability
• Mental health conditions, for example, depression, bipolar disorder, anxiety disorder, schizophrenia, PTSD
• Missing limbs or partially missing limbs
• Mobility impairment, benefiting from the use of a wheelchair, scooter, walker, leg brace(s) and/or other supports
• Nervous system condition, for example, migraine headaches, Parkinson’s disease, multiple sclerosis (MS)
• Neurodivergence, for example, attention-deficit/hyperactivity disorder (ADHD), autism spectrum disorder, dyslexia, dyspraxia, other learning disabilities
• Partial or complete paralysis (any cause)
• Pulmonary or respiratory conditions, for example, tuberculosis, asthma, emphysema
• Short stature (dwarfism)
• Traumatic brain injury

Disability Status Select...

PUBLIC BURDEN STATEMENT: According to the Paperwork Reduction Act of 1995 no persons are required to respond to a collection of information unless such collection displays a valid OMB control number. This survey should take about 5 minutes to complete.