IT Security Engineer

Alpaca is a brokerage infrastructure company providing developer APIs for stocks, options, fixed income, and crypto trading, plus tokenization infrastructure for TradFi–DeFi markets.

Series DRecently funded
San Mateo, California, United States
About Alpaca

Alpaca provides API-first brokerage infrastructure for fintechs, institutions, algorithmic traders, and developers. Its offerings include Broker API, Trading API, market data, self-clearing brokerage services, crypto services, and the Instant Tokenization Network for in-kind minting and redemption of tokenized assets.

View jobs by Alpaca

Skills

About the Role

You will own security standards and controls for identity, endpoint, email, domain, and network access security. You will maintain SSO, MFA, privileged-access, EDR, and device-posture requirements; measure control effectiveness; support incident response; investigate security alerts; and provide clear security guidance. You will also participate in the security on-call rotation.

Requirements

  • 3+ years of experience in IT security, identity security, or security engineering
  • Hands-on experience with an identity provider and SSO, including SAML and OIDC
  • Experience enforcing phishing-resistant MFA, including FIDO2 or hardware security keys
  • Hands-on experience with an EDR platform
  • Scripting or automation experience with Python, Bash, or PowerShell
  • Experience with Zero Trust network access or device-posture controls
  • Knowledge of SPF, DKIM, DMARC, and phishing response
  • Experience translating security requirements into IT operational workflows
  • Experience investigating identity, endpoint, or email security alerts
  • Willingness to participate in an on-call rotation

Responsibilities

  • Define and maintain SSO and conditional-access standards across cloud, SaaS, and internal systems
  • Own and enforce phishing-resistant MFA standards
  • Maintain privileged-access standards, approval policies, and periodic access reviews
  • Partner on timely, complete, and auditable access changes
  • Own EDR policy and tuning
  • Maintain device-posture and secure network-access requirements
  • Measure identity and endpoint controls and remediate gaps
  • Partner on identity, endpoint, and email detections and response playbooks
  • Maintain administrator-access baselines for critical SaaS platforms and vendor accounts
  • Assess identity and account impacts from vendor security events
  • Own email authentication standards and email security configuration
  • Maintain domain-protection standards and monitor lookalike domains
  • Triage phishing reports and coordinate takedowns
  • Lead identity, endpoint, and email aspects of security incidents
  • Participate in the Security Operations on-call rotation
  • Provide clear security guidance to IT and employees

Benefits

  • Stock options
  • Health benefits
  • One-time USD 500 new-hire home-office setup
  • USD 150 monthly stipend via a Brex Card