Senior Cybersecurity Engineer, Identity & Access Management

Description

The company builds defense products on its own distributed network technology, used by warfighters, commercial air operators, and border protection teams. It was founded in 2022, has raised $1 billion from investors including 8VC, Accel, and Valor Equity Partners, and has 500+ employees across five offices in Los Angeles, Washington, D.C., San Francisco, San Diego, and London.

The role owns the identity layer protecting controlled unclassified information and export-controlled technical data. The goal is to make the identity provider, IAM, PAM, PIM, and secrets platforms behave as one system that meets CMMC Level 2, NIST SP 800-171, DFARS 252.204-7012, and ITAR, while staying practical for daily users.

You will turn policy into working access controls, working with security operations, IT, HR, and compliance from hire to departure. It is a hands-on position with real say in the future direction of the identity architecture.

Responsibilities

• Design, build, and run identity architecture and role-based access control across cloud and on-premises directories.
• Automate the IAM steps of joiner, mover, and leaver processes across identity, directory, cloud, and secrets systems, so access is granted at hire, changed on role moves, and removed quickly at exit. HR and IT own the employee record and device steps.
• Design and tune authentication policies, conditional access, phishing-resistant MFA, and device compliance rules.
• Create identity-focused detections and threat hunts in the SIEM, EDR, and SOAR tools, and help the SOC with identity investigations.
• Run and improve a tiered admin model, including privileged access workstations and separate administrator accounts.
• Manage privileged identity management, including just-in-time role activation and privileged access reviews.
• Run the enterprise password and secrets platform, covering role-based enforcement, vault layout, SSO integration, and storage of privileged and shared credentials.
• Manage cloud IAM, including role assignments, service identities, and workload identity federation.
• Connect SaaS and internal apps to SSO using SAML and OpenID Connect, and to SCIM for automated provisioning.
• Keep Active Directory secure through account lifecycle upkeep, service account and gMSA management, and continuous attack path analysis.
• Carry out periodic access reviews and produce evidence for the NIST SP 800-171 Access Control and Identification and Authentication families.
• Write and maintain IAM policies, standards, and procedures.

Requirements

• Bachelor's degree or equivalent experience in computer science, cybersecurity, information security, IT, information assurance, or a related field, plus 5+ years of cybersecurity engineering work with growing responsibility; or a Master's degree with 3+ years of relevant experience.
• At least two years focused on IAM.
• Hands-on experience running an identity provider in production.
• Hands-on experience administering Entra ID or Active Directory.
• Experience running the provisioning, access change, and deprovisioning steps of a JML process.
• Experience designing authentication policies and rolling out phishing-resistant MFA across an organization.
• Working knowledge of Kerberos, NTLM, LDAP, SAML, OAuth 2.0, OpenID Connect, and SCIM.
• Scripting in PowerShell, Python, or a similar language, including work with identity provider APIs.
• Familiarity with NIST SP 800-207 Zero Trust Architecture and NIST SP 800-171 or NIST SP 800-53.
• Experience producing compliance evidence for NIST SP 800-171, CMMC, FedRAMP, or a similar framework.
• Clear written communication for technical runbooks and policy documents.
• Preferred: IAM experience in a cloud platform such as Microsoft Azure or AWS.
• Preferred: experience administering an enterprise password or secrets management platform.
• Preferred: experience with identity automation platforms.
• Preferred: experience with Microsoft 365 GCC High or another US government cloud environment.
• Preferred: experience implementing PIM, PAWs, or a tiered administrative model.
• Preferred: experience with Active Directory attack path tools such as BloodHound or PingCastle.
• Preferred: proficiency in a query language such as ES|QL, KQL, or similar.
• Preferred: experience deploying certificate-based authentication or FIDO2 security keys.
• Preferred: a relevant certification such as Microsoft Certified: Identity and Access Administrator Associate (SC-300) or CISSP.
• Preferred: experience working in the Defense Industrial Base (DIB).

Conditions

Onsite role.

Base salary range is $140,000 - $200,000. This covers base pay only and excludes bonus, equity, and benefits. It is an estimate, and the actual offer may vary based on experience, education, training, critical skills, and business needs.

Candidates whose pay expectations fall outside the range are still welcome to apply.

Benefits

• Medical, dental, and vision coverage, 100% paid by the company.
• 401(k) with a 50% company match on up to 6% of pay, plus FSA, HSA, life insurance, and more.
• Free lunch every day when working onsite, a fully stocked kitchen, unlimited PTO, and a casual dress code.
• Competitive base pay, generous pre-IPO stock option grants, and relocation assistance.
• Annual bonuses are coming soon.