IT Security & Identity Engineer

Description

The company builds devices that create a two-way interface with the brain, aimed at restoring movement for paralyzed people and sight for blind people, and changing how people use digital tools.

The corporate IT team runs the environment that engineers, scientists and clinicians rely on daily. The Security & Identity function decides who can reach which systems, from which devices and under which conditions.

This role owns the identity provider, SSO federation and lifecycle automation, and leads endpoint protection, detection and vulnerability management with the wider IT team.

The work is build-and-operate: you design controls, implement them in Terraform through GitLab, then run them in production, including on-call. The environment is managed as code, and the aim is access that is both secure and easy to use at a fast-moving company.

The base pay range is $99,000 to $185,000 USD, set by job-related skills, experience, and relevant education or training. Full-time employees also receive RSU equity.

Responsibilities

• Design, deploy and run identity and access management across Google Workspace, Microsoft Entra and integrated SaaS apps, including SSO federation (SAML, OIDC, OAuth 2.0) and SCIM provisioning for business-critical tools.
• Manage the IdP, group membership, app assignments and conditional access as versioned, reviewable code in Terraform and GitLab CI/CD.
• Automate identity lifecycle from onboarding to offboarding, covering RBAC, attribute-driven groups, just-in-time access and less standing privilege.
• Design and run strong authentication: phishing-resistant MFA (FIDO2/WebAuthn, passkeys, hardware tokens), certificate-based authentication (X.509, 802.1x), and device-trust conditions tied to MDM compliance.
• Own endpoint security on macOS, Windows and Linux with the IT team: EDR policy and operations, disk encryption, secure baselines, and MDM compliance enforcement (Intune, Jamf or similar).
• Centralize identity, endpoint, SaaS and network logs in Grafana/Loki, Prometheus or a SIEM, write detections for identity abuse and endpoint compromise, and tune alerts.
• Run enterprise vulnerability management: scanning, prioritization, remediation with system owners, and proof of closure.
• Harden IT services used by engineering, science and clinical staff, including email, file shares, directory services, collaboration tools and internal apps, and review permissions and group membership.
• Work with system, network and application owners to run services securely on the Tailscale and FortiGate network, covering authentication, authorization, logging, patching and least privilege.
• Lead or support detection, triage and incident response for corporate IT, and take part in the IT on-call rotation.
• Run regular access reviews and audits, and produce evidence for HIPAA, PII handling and SOC 2 or comparable frameworks with Compliance.
• Build scripts and automation in Python, Bash or PowerShell for baselines, evidence collection, health checks and remediation.
• Propose and implement improvements through the change control process, and define and follow standards for design, testing and rollout.
• Act as the IAM and security expert for the IT team, giving technical guidance and mentoring colleagues.

Requirements

• A bachelor's degree in computer science, cybersecurity or another STEM field, or 5+ years of enterprise IT security engineering experience instead.
• 5+ years hands-on securing corporate IT, covering identity and MFA, endpoints, logging and detection, vulnerability management, and email or file services.
• Proven experience running an enterprise IdP (Google Workspace, Microsoft Entra or Okta), including SSO federation, SCIM, MFA enforcement, conditional access and full user lifecycle management.
• Solid working knowledge of SAML, OIDC, OAuth 2.0 and SCIM.
• Hands-on work managing infrastructure or identity configuration with Terraform and Git-based workflows.
• Experience operating at least two of: enterprise EDR/AV, centralized logging or SIEM, enterprise vulnerability management platform, enterprise MDM.
• Scripting skill in Python, Bash or PowerShell for security automation and integrations.
• Strong communication with IT engineers and with non-technical scientists and clinicians, explaining security tradeoffs and risk decisions clearly.
• Preferred: experience rolling out phishing-resistant MFA at scale (FIDO2/WebAuthn, passkeys, hardware tokens, smart cards).
• Preferred: certificate-based authentication and PKI work (TLS, X.509, 802.1x, internal CA management).
• Preferred: zero-trust experience, including device trust, Tailscale or a comparable mesh VPN, and identity-aware access.
• Preferred: detection engineering in Grafana/Loki, a SIEM or similar tools.
• Preferred: hardening Windows, macOS and Linux endpoints and servers, and securing file shares, email gateways and internal applications.
• Preferred: privileged access management, just-in-time access and privilege escalation reduction.
• Preferred: SOC or blue-team incident response on enterprise IT estates.
• Preferred: configuration management with Ansible or similar, and GitLab CI/CD pipelines.
• Preferred: familiarity with NIST 800-53, CIS Controls or ISO 27001 control families as applied in IT security engineering.
• Preferred: experience in regulated environments such as HIPAA, SOC 2 or similar.
• The company handles patient health information and PII, so you must follow HIPAA rules and the company's data privacy policies and show a commitment to confidentiality. The role may involve access to protected health information (PHI).

Conditions

Full-time position with a base salary range of $99,000 to $185,000 USD, set by job-related skills, experience, and relevant education or training.

Full-time employees receive RSU equity in addition to base salary.

The role may involve access to protected health information (PHI).

Benefits

• Excellent medical, dental and vision insurance through a PPO plan.
• 401(k) plan (interns are initially excluded until they work 1,000 hours).
• Equity in the form of RSUs (temporary employees and interns excluded).
• Parental leave (temporary employees and interns excluded).
• Flexible time off (temporary employees and interns excluded).
• Paid holidays.
• Commuter benefits.
• Meals provided.
• Growth potential: team members with outsized impact advance quickly.
• The chance to work alongside highly skilled experts from many fields on a mission to change lives.