Security Engineer, Identity and Access Management (IAM)

K2 Space Corporation is building high-power satellite platforms for commercial and government missions. The Security Engineer will support the identity platform governing authentication and authorization across corporate, engineering, and mission environments, including SSO, MFA, lifecycle automation, access reviews, privileged access, and identity operations automation.

What you'll do:

• Administer and support the enterprise identity platform, including the identity provider, single sign-on, and directory services across corporate, engineering, and mission environments
• Onboard SaaS and internal applications to SSO and automated provisioning using SAML, OIDC, and SCIM, retiring local accounts and shared credentials as you go
• Operate and improve identity lifecycle workflows, including joiner, mover, and leaver processes, provisioning and deprovisioning, and access requests
• Help drive adoption of phishing-resistant MFA (FIDO2/WebAuthn) and support users through enrollment and rollout
• Maintain role-based access groups and entitlements under established least-privilege standards, and flag where access models need to evolve
• Support privileged access management operations, including administrator accounts, service accounts, and break-glass credential handling
• Assist with secrets management hygiene, including credential rotation for the non-human accounts used by automated pipelines
• Help implement and monitor conditional access policies, and escalate anomalies in authentication patterns
• Execute access review and certification campaigns and collect the evidence auditors and customers require
• Write scripts and contribute to infrastructure as code that automate repetitive identity operations rather than resolving them ticket by ticket
• Triage identity-related tickets and incidents, and partner with security operations on investigations involving credential abuse or MFA fatigue attacks
• Contribute to identity documentation, runbooks, and standards, and keep them current as the environment changes

What they're looking for:

• 1–3 years of experience in identity and access management, security engineering, IT systems administration, or a related technical role (internships and co-ops count)
• Hands-on experience with an enterprise identity provider (e.g., Okta, Microsoft Entra ID, Ping, or Google Identity), including SSO, MFA, and user or group administration
• Foundational understanding of identity protocols and standards such as SAML, OIDC, OAuth 2.0, SCIM, and LDAP, and a desire to go deep on them
• Familiarity with least-privilege and role-based access concepts and why they matter
• Scripting experience in a modern language such as Python, PowerShell, or Go, used to automate tasks or integrate systems
• Exposure to at least one major cloud provider (AWS, Azure, or GCP) and its IAM model
• Bachelor's degree in cyber security, computer science, information systems, engineering, or another STEM discipline; OR equivalent hands-on experience
• Comfortable working with mission critical and sensitive systems, with a sense of urgency appropriate to the responsibilities
• Strong attention to detail, clear written and verbal communication, and a genuine curiosity about how access systems work and break
• The person hired for this role must therefore either be a “U.S. person” as defined by [22 C.F.R. § 120.15](https://www.law.cornell.edu/cfr/text/22/120.15) or otherwise eligible for a federally issued export control license
• Entry-level security or identity certifications such as CompTIA Security+, Okta Certified Professional or Administrator, Microsoft SC-300, or equivalent hands-on experience
• Experience with infrastructure as code (Terraform, CloudFormation, or CDK)

Benefits:

• Equity in the company
• Paid time off
• Medical, dental, and vision coverage
• Life insurance
• Paid parental leave
• Many other perks