Remote opportunity at
AlpacaIT Security Engineer
Alpaca is looking for an IT Security Engineer to oversee and enforce security standards protecting workforce identities, endpoints, and key business systems. Operating globally, Alpaca provides…
Career Tools
About This Role
Alpaca is looking for an IT Security Engineer to oversee and enforce security standards protecting workforce identities, endpoints, and key business systems. Operating globally, Alpaca provides developer-friendly brokerage infrastructure APIs to institutional clients across forty countries. In this fully remote role, the engineer will manage identity and access controls, multi-factor authentication, privileged access, endpoint security, secure network access, and email protection. Reporting directly to the Enterprise Security Architect, this position…
Job Description
Alpaca is looking for an IT Security Engineer to oversee and enforce security standards protecting workforce identities, endpoints, and key business systems. Operating globally, Alpaca provides developer-friendly brokerage infrastructure APIs to institutional clients across forty countries. In this fully remote role, the engineer will manage identity and access controls, multi-factor authentication, privileged access, endpoint security, secure network access, and email protection.
Reporting directly to the Enterprise Security Architect, this position collaborates closely with IT, DevOps, Engineering, GRC, and Security Operations teams. Core duties involve establishing security baselines for SaaS platforms, evaluating vendor security events, directing phishing investigations, handling incident containment, and participating in an on-call rotation after initial onboarding. The ideal candidate brings a background in identity or IT security, practical experience with single sign-on and endpoint detection platforms, and strong communication skills for cross-functional collaboration during security incidents.
Responsibilities
- Define and maintain security standards for single sign-on and conditional access across internal and cloud-based systems
- Manage multi-factor authentication standards, incorporating phishing-resistant solutions
- Oversee privileged-access policies and conduct regular access reviews alongside system owners
- Partner with IT and People teams to ensure auditable and timely joiner, mover, and leaver processes
- Maintain endpoint detection and response policies while collaborating with IT on deployment
- Establish device-posture and secure network access criteria for business application users
- Measure identity and endpoint control performance and address deficiencies
- Collaborate with Security Operations on identity, endpoint, and email threat detections and response procedures
- Set security baselines for administrator access to critical SaaS environments and vendor accounts
- Assess identity and account implications when vendors report security incidents
- Manage email security configurations and email authentication standards
- Monitor company domains, track lookalike domains, and triage reported phishing attempts for takedowns
- Lead identity, endpoint, and email containment during security incidents
- Join the Security Operations on-call rotation following onboarding and cross-training
- Provide clear security guidance to employees and IT teams to ensure control adoption
Requirements
- At least 3 years of experience in security engineering, identity security, or IT security
- Practical background using identity providers and single sign-on protocols including SAML and OIDC
- Experience enforcing phishing-resistant multi-factor authentication like FIDO2 or hardware security keys
- Hands-on familiarity with endpoint detection and response tools
- Scripting or automation skills in Python, Bash, or PowerShell
- Experience implementing zero-trust network access or device-posture controls
- Working knowledge of email authentication protocols including SPF, DKIM, and DMARC
- Experience partnering with IT departments to translate security policies into daily operational workflows
- Background in investigating alerts related to identity, endpoints, or email
- Willingness to join an on-call rotation
- Strong written and verbal communication abilities, particularly during high-pressure incidents
- Capacity to navigate cross-functional tasks and resolve escalations calmly
Qualifications
- Background in securing financial, trading, or heavily regulated platforms
- Familiarity with compliance standards such as SOC 2 or ISO 27001
- Experience with just-in-time privileged access management tools
- Experience protecting administrator access across SaaS applications
- Familiarity with company-scale password managers and secrets management systems
- Experience working with mobile device management platforms for Windows and macOS
- Familiarity with cloud identity and access management in AWS, GCP, or Azure
Core Skills
Benefits
- Competitive salary and stock options
- Health benefits
- New hire home-office setup with a one-time USD $500 allowance
- Monthly stipend of USD $150 provided via a Brex Card
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
Is this position remote?
Yes, the posting specifies that the role is remote and part of a 100% distributed security team.
What is the salary for this role?
The salary is not stated in the job posting, though competitive salary and stock options are listed as benefits.
What experience level is required?
Applicants must have 3 or more years of experience in IT security, identity security, or security engineering roles.
Will this role involve on-call duties?
Yes, the engineer will participate in a Security Operations on-call rotation after completing onboarding and cross-training.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.