[Hiring] IT Security Engineer @Alpaca

Role Description

We are seeking an IT Security Engineer to own the security standards and controls that protect Alpaca’s workforce identities, endpoints, and critical business systems. The scope includes:

• Identity and access management
• Single sign-on
• Privileged access
• Multi-factor authentication
• Endpoint security
• Secure network access
• Email security

You will maintain those standards, measure how the controls are working, and partner with IT, who run devices and day-to-day administration. This role reports to the Enterprise Security Architect and works closely with IT, DevOps, Engineering, GRC, and the wider Security team. The Security Team is 100% distributed and remote.

Things You Get To Do:

• Identity and Access Security:
  • IAM and SSO Standards: Define and maintain security standards for SSO and conditional access across cloud, SaaS, and internal systems.
  • Multi-Factor Authentication: Own multi-factor authentication standards, including phishing-resistant methods, and keep them enforced.
  • Privileged Access: Maintain privileged-access standards, approval policies, and periodic access reviews with system owners.
  • Joiner, Mover, Leaver: Partner with IT and People teams so access changes are timely, complete, and auditable.
• Endpoint, Email, and Domain Security:
  • EDR Policy: Own endpoint detection and response policy and tuning, with IT handling deployment.
  • Device Posture: Maintain device-posture and secure network access requirements for access to business applications.
  • Control Measurement: Measure identity and endpoint controls and follow up where they are not met.
  • Detection Partnership: Work with Security Operations on identity, endpoint, and email detections and response playbooks.
  • Admin Access: Maintain security baselines for administrator access to critical SaaS platforms and vendor accounts.
  • Vendor Security Events: Assess the identity and account impact when a SaaS provider or vendor reports a security event.
  • Email Security: Own email authentication standards and email security configuration.
  • Domain Protection: Maintain security standards for company domains and for monitoring lookalike domains.
  • Phishing Response: Triage reported phishing and coordinate takedowns.
• Incident Response and Collaboration:
  • Incident Support: Lead the identity, endpoint, and email aspects of security incidents, including account containment.
  • On-Call: Participate in the Security Operations on-call rotation after onboarding and cross-training.
  • Enablement: Give IT and employees clear guidance on security requirements, so controls are adopted without slowing the business.

Qualifications

• Excited about Alpaca’s mission and what we’re building
• 3+ years of experience in IT security, identity security, or security engineering roles
• Hands-on experience with an identity provider and SSO, including SAML and OIDC
• Experience enforcing phishing-resistant MFA, such as FIDO2 or hardware security keys
• Hands-on experience with an endpoint detection and response platform
• Scripting or automation experience (Python, Bash, or PowerShell)
• Experience with zero-trust network access or device-posture controls
• Working knowledge of email authentication (SPF, DKIM, DMARC) and phishing response
• Experience working closely with IT teams and translating security requirements into operational workflows
• Experience investigating identity, endpoint, or email security alerts
• Willing to participate in an on-call rotation
• Strong written and verbal communication skills, especially during incidents
• Comfortable working cross-functionally and handling escalations calmly and decisively

Requirements

• Experience securing financial, trading, or other highly regulated platforms
• Familiarity with compliance frameworks such as SOC 2 or ISO 27001
• Experience with just-in-time privileged access tools
• Experience securing administrator access to SaaS platforms
• Experience with password managers and secrets management at company scale
• Experience with MDM platforms for macOS and Windows
• Experience with cloud IAM in AWS, GCP, or Azure
• Ability to balance security rigor with operational efficiency and business needs

Benefits

• Competitive Salary & Stock Options
• Health Benefits
• New Hire Home-Office Setup: One-time USD $500
• Monthly Stipend: USD $150 per month via a Brex Card