Principal Security Engineer, Operations at K2 Space · LumiJobs

Responsibilities

K2 is a target for sophisticated adversaries, from nation-state actors to criminal groups, all intent on stealing or disrupting the technology behind a new class of high-powered satellites. This role owns detection and response for our corporate environment: you’ll run and mature our SIEM, build detections against real adversary tradecraft, triage what fires, and drive incidents from first signal through containment, eradication, and lessons learned. You’ll be deeply hands-on across identity, endpoints, SaaS, network, and cloud telemetry, closing the visibility gaps you find rather than simply documenting them. This is a role for someone who thrives on real-world impact and operates with urgency when it counts. Every detection you write and every incident you shut down directly supports our ability to move fast, operate confidently, and deliver breakthrough satellite capabilities.
Own day-to-day detection and response across the corporate environment, from alert triage and investigation through containment and remediation
Administer and mature the SIEM, including log source onboarding, parsing and normalization, telemetry enrichment, rule tuning, and platform health, retention, and cost
Write, test, and maintain detection content mapped to MITRE ATT&CK using detection-as-code practices, including version control, peer review, and automated testing
Act as incident commander for corporate security incidents, coordinating stakeholders and delivering timelines, root cause analysis, and post-incident follow-through
Build response playbooks and automation across SOAR, scripting, and vendor APIs to reduce time to detect, triage, and contain
Threat hunt proactively across endpoint, identity, SaaS, and cloud telemetry using threat intelligence and hypotheses about adversary behavior
Run adversary emulation and purple team exercises to validate detection coverage, then close the gaps you find
Perform host, network, and cloud forensics across macOS, Windows, and Linux to reconstruct attacker activity and scope impact
Investigate phishing, business email compromise, credential abuse, and insider risk in partnership with IT, HR, and Legal
Partner with IT and infrastructure teams to harden identity, endpoint, and network controls, including conditional access, EDR policy, MDM baselines, segmentation, and secure remote access, informed by what investigations reveal
Translate detection and incident findings into vulnerability management priorities and security architecture improvements

Qualification

Experience investigating endpointKnowledge of operating systemsExperience with threat intelligenceExperience protecting engineeringPrior experience in a defense

Required

10+ years of experience in security operations, detection and response, or incident response, preferably in a fast-paced startup or technology environment
Hands-on experience administering and tuning a SIEM (e.g., Splunk, Microsoft Sentinel, Elastic, Panther, or Chronicle), including log source onboarding, parsing, and detection rule development
Demonstrated experience leading security incidents end to end, from detection and scoping through containment, eradication, and post-incident review
Strong working knowledge of attacker tactics, techniques, and procedures (TTPs), the MITRE ATT&CK framework, and the evidence sources needed to investigate them
Experience investigating endpoint, identity, network, and cloud telemetry across macOS, Windows, and Linux, including EDR, identity provider, and SaaS audit logs
2+ years of development experience with any modern programming language (including but not limited to Python, Go, C++, Rust) used to automate detection, enrichment, and response, in lieu of a degree; OR a bachelor’s degree in security engineering, cyber security, computer science, engineering, math, or other STEM discipline
Knowledge of operating systems, networking, cloud and SaaS platforms, security best practices, and log analysis at scale
Comfortable working with mission critical and sensitive systems, with a sense of urgency appropriate with responsibilities
Due to the high visibility of this position, excellent interpersonal skills, attention to detail, and problem-solving skills

Preferred

Bachelor’s degree (or equivalent) in computer science or engineering
Detection and response certifications such as GCIH, GCFA, GCIA, GCDA, or OSCP, or equivalent hands-on experience
Experience building detection-as-code pipelines, security data lakes, or ETL for security telemetry
Experience with cloud detection and response in AWS, Azure, or GCP
Experience with threat intelligence, malware analysis, or reverse engineering
Experience protecting engineering, manufacturing, OT, or mission and ground segment environments
Prior experience in a defense, aerospace, or other ITAR-regulated environment
Security community contributions such as tooling, blog posts, conference talks, or CTFs

Principal Security Engineer, Operations

Responsibilities

Qualification

Required

Preferred

Benefits

Company

K2 Space

More roles at K2 Space