Senior Identity & Authorization Engineer

True Anomaly; Long Beach, Denver (CA, CO); On-site; USD 180,000 - 260,000; Full time

Benefits offered by this job

Equity + Benefits

Platinum healthcare

Flexible work hours/location

Stock options

Job summary

True Anomaly seeks a Senior Identity & Authorization Engineer to build and secure our space operations platform. You will deploy Kubernetes-native identity infrastructure, implement fine-grained authorization, and drive compliance through policy-as-code in highly classified environments.

This role offers equity, platinum healthcare, and flexible work options. Ideal candidates bring 10+ years in security engineering with 5+ focused on identity, plus TS/SCI eligibility.

Qualifications

• Active TS/SCI clearance eligible; U.S. citizen or permanent resident
• 10+ years in platform/security engineering with 5+ years in identity/authorization
• Design and operate multi-tenant SaaS security for high-assurance systems
• Kubernetes production experience with 3+ years
• Experience deploying/operating at least one K8s-native IdP (Keycloak, Dex) or IAM system
• Experience implementing RBAC/ABAC/REBAC in production
• Strong understanding of zero trust models per NIST SP 800-207
• Knowledge of NIST 800-53, CMMC 3+ or FedRAMP High
• Scripting: Python/Go/Bash for automation

Responsibilities

• Architect and deploy Kubernetes-native identity and authorization infrastructure for IL6 (SECRET) multi-tenant environments
• Serve as technical authority for identity controls during ATO processes
• Design multi-tenant isolation strategies with zero lateral movement
• Evaluate and harden self-hosted IdPs for classified clusters
• Design authorization models (RBAC/ABAC/ReBAC) for space operations
• Implement workload identity frameworks and service mesh authentication
• Build policy-as-code systems for runtime enforcement
• Integrate with government identity systems (CAC/PIV, LDAP, AD)
• Collaborate on secret management with Vault/KV and key lifecycle
• Define authentication/authorization contracts for microservices
• Engage with customers and auditors during ATO processes
• Stay current on identity/auth technologies for classified environments

Skills

Identity infrastructure

Kubernetes production

Zero Trust

Policy-as-code

Security architecture

Education

Bachelor's degree or higher in a relevant field

Tools

Keycloak

Dex

Authentik

SPIFFE/SPIRE

OPA

Istio

Linkerd

Cilium

HashiCorp Vault

Azure Key Vault

Job description

Space is a warfighting domain. True Anomaly seeks those with the talent and ambition to build the technology that secures it.

OUR MISSION

True Anomaly delivers decisive capabilities for space superiority. We build autonomous spacecraft, advanced payloads, mission software, and space‑based interceptors — enabling the U.S. and its Allies to secure the space environment and counter threats from the ultimate high ground.

OUR VALUES

• Be the offset. We create asymmetric advantages with creativity and ingenuity.
• What would it take? We challenge assumptions to deliver ambitious results.
• It’s the people. Our team is our competitive advantage and we are better together.

YOUR MISSION

Software is the central nervous system for True Anomaly's engineering and product thesis. As we deploy our space operations platform into classified environments, identity and authorization become critical technical challenges requiring deep specialization. True Anomaly is seeking a highly experienced Senior Identity & Authorization Engineer to build the multi‑tenant identity infrastructure that enables secure operations at IL6 (SECRET) and beyond. You'll deploy and integrate Kubernetes‑native identity platforms, implement fine‑grained authorization models for space operations, and provide deep technical expertise on identity/auth during compliance processes. Working closely with our security and platform teams, you'll evaluate and integrate modern authorization frameworks (ReBAC, SPIFFE/SPIRE, OPA), build policy‑as‑code enforcement systems, and ensure our identity architecture meets the rigorous standards required for classified environments.

You'll have ownership of challenging, green‑field problems and a chance to fundamentally impact the outcome of future conflict (and the future of the company), all while enjoying world‑class benefits including platinum healthcare, flexible work hours/location, highly competitive compensation and a generous stock options package.

RESPONSIBILITIES

• Architect and deploy Kubernetes‑native identity and authorization infrastructure for IL6 (SECRET) multi‑tenant environments
• Serve as a technical authority for identity/auth controls during ATO processes, documenting and evidencing compliance for IdP components
• Design and implement multi‑tenant isolation strategies ensuring zero lateral movement between customer/program boundaries
• Evaluate, deploy, and harden self‑hosted IdPs (Keycloak, Dex, Authentik, etc.) for classified Kubernetes clusters
• Design authorization models (RBAC, ABAC, ReBAC) for space operations use cases with fine‑grained access control requirements
• Implement workload identity frameworks (SPIFFE/SPIRE, K8s projected tokens) and service mesh authentication (Istio, Linkerd, Cilium)
• Build policy‑as‑code systems (OPA/Gatekeeper, Kyverno, Cedar) for automated compliance enforcement at runtime
• Integrate with government identity systems (CAC/PIV, LDAP, Active Directory) and legacy SAML 2.0 applications
• Collaborate with security team on secret management strategy (HashiCorp Vault, Azure Key Vault) with encryption key lifecycle for IL6 environments
• Work with application teams to define authentication/authorization contracts for microservices
• Partner with customers and government auditors during ATO processes to demonstrate compliance and address findings
• Stay current on emerging identity/auth technologies and evaluate applicability to classified environments

QUALIFICATIONS

• Clearance: Eligible for TS/SCI clearance (U.S. citizen or lawful permanent resident), active clearance strongly preferred
• Experience: 10+ years in platform/security engineering with 5+ years focused on identity, authentication, or authorization systems
• Multi‑Tenant Architecture: Designed and implemented proper tenant isolation (zero lateral movement, strong security boundaries) for SaaS, defense, or high‑assurance systems
• Kubernetes Production Experience: Deployed and operated production Kubernetes clusters with 3+ years experience
• Identity Infrastructure: Production experience deploying/operating at least one K8s‑native IdP (Keycloak, Dex, etc.) or enterprise IAM system
• Authorization Design: Implemented RBAC, ABAC, or ReBAC authorization models in production systems
• Zero Trust Principles: Deep understanding of NIST SP 800‑207 and practical zero trust architecture patterns
• Compliance Frameworks: Working knowledge of NIST 800‑53, CMMC Level 3+, or FedRAMP High requirements
• Scripting/Automation: Proficiency in Python, Go, or Bash for automation and tooling

PREFERRED SKILLS AND EXPERIENCE

• Active TS/SCI clearance (or ability to start immediately upon clearance grant)
• IL4/IL5 deployment and operations experience (IL6 is nice‑to‑have but not required)
• ATO Experience: Participated in at least one ATO process for NIST 800‑53, CMMC, FedRAMP, or IL4/IL5 systems
• Experience with modern authorization frameworks (SpiceDB, Authzed, OpenFGA, Ory Keto)
• SPIFFE/SPIRE workload identity implementation experience
• HashiCorp Vault or enterprise secret management in classified or high‑assurance environments
• CAC/PIV card integration and PKI certificate management
• Policy‑as‑code (OPA/Rego, Kyverno, Cedar) for runtime enforcement
• Experience in aerospace, defense, intelligence community, or national security space
• Startup or fast‑paced environment experience (balance velocity with compliance rigor)

NICE-TO-HAVE

• CISSP, CCSP, or other security certifications
• Contributed to open‑source identity/auth projects (Keycloak, Dex, OPA, SPIFFE, etc.)
• Experience with cross‑domain solutions (CDS) or multi‑level security (MLS) systems
• Previous experience at defense prime, IC contractor, or FAANG Gov (AWS/Azure/Google public sector)

COMPENSATION

• Equity + Benefits including Health, Dental, Vision, HRA/HSA options, PTO and paid holidays, 401K, Parental Leave

ADDITIONAL REQUIREMENTS

• Work Location: Successful candidates will be located near Denver or Colorado Springs. While we observe a hybrid work environment, some work must be done on site.
• Work environment: the work environment; temperature, noise level, inside or outside, or other factors that will affect the person's working conditions while performing the job.
• Physical demands: the physical demands of the job, including bending, sitting, lifting and driving.

To conform to U.S. Government space technology export regulations, including the International Traffic in Arms Regulations (ITAR) you must be a U.S. citizen, lawful permanent resident of the U.S., protected individual as defined by 8 U.S.C. 1324b(a)(3), or eligible to obtain the required authorizations from the U.S. Department of State.

True Anomaly is committed to equal employment opportunity on any basis protected by applicable state and federal laws. If you have a disability or additional need that requires accommodation, please do not hesitate to let us.