Principal Security Engineer, Operations

k2spacecorporation; Los Angeles (CA); On-site; USD 140,000 - 210,000; Full time

Job summary

K2 is seeking a senior security operations professional to own detection and response for our corporate environment. You will manage the SIEM, build detections against MITRE ATT&CK, and drive incidents from detection through containment and lessons learned.

Ideal candidates have 10+ years in security operations, hands-on SIEM experience, and a track record leading end-to-end incidents in fast-paced settings.

Qualifications

• 10+ years of experience in security operations, detection and response, or incident response.
• Hands-on experience administering and tuning a SIEM (e.g., Splunk, Microsoft Sentinel, Elastic, Panther, or Chronicle).
• Demonstrated experience leading security incidents end to end, from detection and scoping through containment, eradication, and post-incident review.
• Strong working knowledge of attacker tactics, techniques, and procedures (TTPs), the MITRE ATT&CK framework, and the evidence sources needed to investigate them.
• Experience investigating endpoint, identity,

Responsibilities

• Own day-to-day detection and response across the corporate environment, from alert triage and investigation through containment and remediation
• Administer and mature the SIEM, including log source onboarding, parsing and normalization, telemetry enrichment, rule tuning, and platform health, retention, and cost
• Write, test, and maintain detection content mapped to MITRE ATT&CK using detection-as-code practices, including version control, peer review, and automated testing
• Act as incident commander for corporate security incidents, coordinating stakeholders and delivering timelines, root cause analysis, and post-incident follow-through
• Build response playbooks and automation across SOAR, scripting, and vendor APIs to reduce time to detect, triage, and contain
• Threat hunt proactively across endpoint, identity, SaaS, and cloud telemetry using threat intelligence and hypotheses about adversary behavior
• Run adversary emulation and purple team exercises to validate detection coverage, then close the gaps you find
• Perform host, network, and cloud forensics across macOS, Windows, and Linux to reconstruct attacker activity and scope impact
• Investigate phishing, business email compromise, credential abuse, and insider risk in partnership with IT, HR, and Legal
• Partner with IT and infrastructure teams to harden identity, endpoint, and network controls, including conditional access, EDR policy, MDM baselines, segmentation, and secure remote access, informed by what investigations reveal
• Translate detection and incident findings into vulnerability management priorities and security architecture improvements
• Participate in an on-call rotation for security escalations, including occasional after-hours and weekend response
• Maintain runbooks, detection documentation, and standard operating procedures, and mentor junior team members on investigation and response tradecraft
• Support compliance and audit efforts by producing monitoring, detection, and incident response evidence as needed

Skills

Security operations

Incident response

MITRE ATT&CK

Threat hunting

Tools

Splunk

Microsoft Sentinel

Elastic

Panther

Chronicle

Job description

K2 is building the largest and highest-power satellites ever flown, unlocking performance levels previously out of reach across every orbit. Backed by over $1 billion in total funding from leading investors including Altimeter Capital, ICONIQ, Kleiner Perkins, Lightspeed Venture Partners, Redpoint Ventures, and T. Rowe Price - and with over $1 billion in signed contracts across commercial and US government customers, we're mass-producing the highest-power satellite platforms ever built for missions from LEO to deep space.

The rise of heavy-lift launch vehicles is shifting the industry from an era of mass constraint to one of mass abundance, and we believe this new era demands a fundamentally different class of spacecraft. Engineered to survive the harshest radiation environments and to fully capitalize on today's and tomorrow's massive rockets, K2 satellites deliver unmatched capability at constellation scale and across multiple orbits.

With multiple launches in 2027 and plans to scale to 100 satellites a year, we're Building Bigger - helping develop the solar system and build toward a Kardashev Type II (K2) civilization. If you are a motivated individual who thrives in a fast-paced environment and you're excited about contributing to the success of a high-growth Series D-funded company, we'd love for you to apply.

The Role

K2 is a target for sophisticated adversaries, from nation-state actors to criminal groups, all intent on stealing or disrupting the technology behind a new class of high-powered satellites. This role owns detection and response for our corporate environment: you'll run and mature our SIEM, build detections against real adversary tradecraft, triage what fires, and drive incidents from first signal through containment, eradication, and lessons learned. You'll be deeply hands-on across identity, endpoints, SaaS, network, and cloud telemetry, closing the visibility gaps you find rather than simply documenting them. This is a role for someone who thrives on real-world impact and operates with urgency when it counts. Every detection you write and every incident you shut down directly supports our ability to move fast, operate confidently, and deliver breakthrough satellite capabilities.

Responsibilities

• Own day-to-day detection and response across the corporate environment, from alert triage and investigation through containment and remediation
• Administer and mature the SIEM, including log source onboarding, parsing and normalization, telemetry enrichment, rule tuning, and platform health, retention, and cost
• Write, test, and maintain detection content mapped to MITRE ATT&CK using detection-as-code practices, including version control, peer review, and automated testing
• Act as incident commander for corporate security incidents, coordinating stakeholders and delivering timelines, root cause analysis, and post-incident follow-through
• Build response playbooks and automation across SOAR, scripting, and vendor APIs to reduce time to detect, triage, and contain
• Threat hunt proactively across endpoint, identity, SaaS, and cloud telemetry using threat intelligence and hypotheses about adversary behavior
• Run adversary emulation and purple team exercises to validate detection coverage, then close the gaps you find
• Perform host, network, and cloud forensics across macOS, Windows, and Linux to reconstruct attacker activity and scope impact
• Investigate phishing, business email compromise, credential abuse, and insider risk in partnership with IT, HR, and Legal
• Partner with IT and infrastructure teams to harden identity, endpoint, and network controls, including conditional access, EDR policy, MDM baselines, segmentation, and secure remote access, informed by what investigations reveal
• Translate detection and incident findings into vulnerability management priorities and security architecture improvements
• Participate in an on-call rotation for security escalations, including occasional after-hours and weekend response
• Maintain runbooks, detection documentation, and standard operating procedures, and mentor junior team members on investigation and response tradecraft
• Support compliance and audit efforts by producing monitoring, detection, and incident response evidence as needed

Qualifications

• 10+ years of experience in security operations, detection and response, or incident response, preferably in a fast-paced startup or technology environment
• Hands-on experience administering and tuning a SIEM (e.g., Splunk, Microsoft Sentinel, Elastic, Panther, or Chronicle), including log source onboarding, parsing, and detection rule development
• Demonstrated experience leading security incidents end to end, from detection and scoping through containment, eradication, and post-incident review
• Strong working knowledge of attacker tactics, techniques, and procedures (TTPs), the MITRE ATT&CK framework, and the evidence sources needed to investigate them
• Experience investigating endpoint, identity,