Senior IAM Engineer: Identity & Access Lead

K2 Space; Los Angeles (CA); On-site; USD 150,000 - 220,000; Full time

Job summary

K2 Space is seeking a Senior Security Engineer focused on Identity and Access Management (IAM) to design, build, and operate the identity platform securing authentication and authorization across corporate, engineering, and mission environments.

You will implement modern authentication standards, manage lifecycle automation, and enforce least- privilege access across cloud and on‑prem systems while driving security maturity and automation across the workforce and devices.

Qualifications

• 5+ years of experience in identity and access management, security engineering, or infrastructure engineering.
• Hands‑on experience administering an enterprise identity provider (e.g., Okta, Microsoft Entra ID, Ping, or Google Identity), including SSO, MFA, and conditional access
• Strong working knowledge of identity protocols and standards, including SAML, OIDC, OAuth 2.0, SCIM, LDAP, and Kerberos
• Experience designing and implementing identity lifecycle automation, RBAC or ABAC access models, and access review processes
• Experience with privileged access management and secrets management for both human and machine identities, such asHashiCorpVault or equivalent
• Experience with cloud IAM in AWS, Azure, or GCP, including least‑privilege role and policy design
• 2+ years of development experience with any modern programming language (including Python, Go, C++, Rust) or a bachelor’s degree in security engineering, cyber security, CS, engineering, math, or other STEM
• Comfortable working with mission critical and sensitive systems with urgency appropriate to responsibilities
• Excellent interpersonal skills, attention to detail, and problem‑solving skills

Responsibilities

• Own and mature the enterprise identity platform, including the identity provider, single sign‑on, federation, and directory services across corporate, engineering, and mission environments
• Design and implement authentication standards using modern protocols such as SAML, OIDC, OAuth 2.0, and SCIM, and drive adoption of phishing‑resistant MFA including FIDO2 and WebAuthn
• Build and automate identity lifecycle management, including joiner, mover, and leaver workflows, provisioning and deprovisioning, and just‑in‑time access
• Design and maintain role‑based and attribute‑based access models, entitlement structures, and least‑privilege standards for corporate and engineering systems
• Implement and operate privileged access management for administrators, service accounts, and break‑glass credentials
• Manage machine and workload identity, including secrets management, credential rotation, and the non‑human accounts used by automated pipelines and mission systems
• Onboard SaaS and internal applications to SSO and automated provisioning using SCIM, REST APIs, and webhooks, retiring local accounts and shared credentials as you go
• Implement conditional access and risk‑based authentication policies, then tune them against real access patterns
• Build and run access review and certification campaigns, producing the evidence auditors and customers require
• Harden cloud IAM across AWS, Azure, or GCP, including roles, trust policies, and permission boundaries
• Write code and infrastructure as code to automate identity operations rather than resolving them ticket by ticket
• Partner with security operations on identity threat detection and response, including credential abuse, session hijacking, and MFA fatigue attacks, and support investigations involving identity
• Serve as the identity subject matter expert in architecture and design reviews, acting as a liaison between the security team and engineering
• Maintain identity documentation, runbooks, and standards, and mentor junior team members on identity engineering practices

Skills

IAM security

SAML/OIDC/OAuth

RBAC/ABAC

MFA & conditional access

Secrets management

Cloud IAM

Scripting / IaC

Security engineering

Education

Bachelor’s degree in security engineering or related field

Security certifications (preferred)

Tools

Okta

Microsoft Entra ID

Ping Identity

Google Identity

HashiCorp Vault

AWS IAM

Azure IAM

SCIM

Job description

K2 Space is seeking a Senior Security Engineer focused on Identity and Access Management (IAM) to design, build, and operate the identity platform securing authentication and authorization across corporate, engineering, and mission environments.

You will implement modern authentication standards, manage lifecycle automation, and enforce least- privilege access across cloud and on‑prem systems while driving security maturity and automation across the workforce and devices.