IT Security Engineer

Overview

Own the security standards and controls that protect Alpaca's workforce identities, endpoints, and critical business systems, including identity and access management, single sign-on, privileged access, multi-factor authentication, endpoint security, secure network access, and email security.

What you'll do

• Define and maintain security standards for SSO and conditional access across cloud, SaaS, and internal systems.
• Own multi-factor authentication standards, including phishing-resistant methods, and keep them enforced.
• Maintain privileged-access standards, approval policies, and periodic access reviews with system owners.
• Partner with IT and People teams so joiner, mover, and leaver access changes are timely, complete, and auditable.
• Own endpoint detection and response policy and tuning, with IT handling deployment.
• Maintain device-posture and secure network access requirements for access to business applications.
• Measure identity and endpoint controls and follow up where they are not met.
• Work with Security Operations on identity, endpoint, and email detections and response playbooks.
• Maintain security baselines for administrator access to critical SaaS platforms and vendor accounts.
• Assess the identity and account impact when a SaaS provider or vendor reports a security event.
• Own email authentication standards and email security configuration.
• Maintain security standards for company domains and for monitoring lookalike domains.
• Triage reported phishing and coordinate takedowns.
• Lead the identity, endpoint, and email aspects of security incidents, including account containment.
• Participate in the Security Operations on-call rotation after onboarding and cross-training.
• Give IT and employees clear guidance on security requirements, so controls are adopted without slowing the business.

What you'll need

• Excited about Alpaca's mission and what we're building.
• 3+ years of experience in IT security, identity security, or security engineering roles.
• Hands-on experience with an identity provider and SSO, including SAML and OIDC.
• Experience enforcing phishing-resistant MFA, such as FIDO2 or hardware security keys.
• Hands-on experience with an endpoint detection and response platform.
• Scripting or automation experience (Python, Bash, or PowerShell).
• Experience with zero-trust network access or device-posture controls.
• Working knowledge of email authentication (SPF, DKIM, DMARC) and phishing response.
• Experience working closely with IT teams and translating security requirements into operational workflows.
• Experience investigating identity, endpoint, or email security alerts.
• Willing to participate in an on-call rotation.
• Strong written and verbal communication skills, especially during incidents.
• Comfortable working cross-functionally and handling escalations calmly and decisively.

Nice to have

• Experience securing financial, trading, or other highly regulated platforms.
• Familiarity with compliance frameworks such as SOC 2 or ISO 27001.
• Experience with just-in-time privileged access tools.
• Experience securing administrator access to SaaS platforms.
• Experience with password managers and secrets management at company scale.
• Experience with MDM platforms for macOS and Windows.
• Experience with cloud IAM in AWS, GCP, or Azure.
• Ability to balance security rigor with operational efficiency and business needs.

Details

• Remote, Americas.
• Reports to the Enterprise Security Architect.
• The Security Team is 100% distributed and remote.