IT Security Engineer Remote - Americas at Alpaca

Alpaca is a US-headquartered, global leader in agent-first brokerage infrastructure for stocks, ETFs, options, crypto, fixed income, 24/5 trading, and more. We are a licensed financial services company serving hundreds of financial institutions across 40 countries with our institutional-grade APIs, including broker-dealers, investment advisors, wealth managers, hedge funds, and crypto exchanges, serving over 10 million brokerage accounts. Our global team is a diverse group of experienced engineers, traders, and brokerage professionals dedicated to opening financial services to everyone on the planet.

We are seeking a passionate IT Security Engineer to own the security standards and controls protecting Alpaca’s workforce identities, endpoints, and critical business systems. This role reports to the Enterprise Security Architect and requires close collaboration with IT, DevOps, Engineering, GRC, and the wider Security team. The Security Team is 100% distributed and remote.

Key Responsibilities

Identity and Access Security

• Define and maintain security standards for SSO and conditional access across cloud, SaaS, and internal systems (IAM and SSO Standards).
• Own and enforce multi-factor authentication standards, including phishing-resistant methods (MFA).
• Maintain privileged-access standards, approval policies, and conduct periodic access reviews with system owners.
• Partner with IT and People teams to ensure timely, complete, and auditable access changes for joiners, movers, and leavers.

Endpoint, Email, and Domain Security

• Own the endpoint detection and response policy and tuning, while IT handles deployment.
• Maintain device-posture and secure network access requirements for accessing business applications.
• Measure identity and endpoint controls and follow up when controls are not met.
• Collaborate with Security Operations on identity, endpoint, and email detection and response playbooks.
• Maintain security baselines for administrator access to critical SaaS platforms and vendor accounts.
• Assess the identity and account impact following security events reported by SaaS providers or vendors.
• Own email authentication standards and email security configuration.
• Maintain security standards for company domains and for monitoring lookalike domains.
• Triage reported phishing incidents and coordinate takedown efforts.

Incident Response and Collaboration

• Lead identity, endpoint, and email aspects of security incidents, including account containment.
• Participate in the Security Operations on-call rotation after onboarding and cross-training.
• Provide clear guidance to IT and employees regarding security requirements to ensure controls are adopted without hindering business operations.

Who You Are (Must-Haves)

• You are excited about Alpaca’s mission and what we are building.
• You possess 3+ years of experience in IT security, identity security, or security engineering roles.
• You have hands-on experience with an identity provider and SSO, including SAML and OIDC.
• You have experience enforcing phishing-resistant MFA, such as FIDO2 or hardware security keys.
• You have hands-on experience with an endpoint detection and response platform.
• You possess scripting or automation experience using Python, Bash, or PowerShell.
• You have experience with zero-trust network access or device-posture controls.
• You have working knowledge of email authentication (SPF, DKIM, DMARC) and phishing response.
• You have experience working closely with IT teams and translating security requirements into operational workflows.
• You have experience investigating identity, endpoint, or email security alerts.
• You are willing to participate in an on-call rotation.
• You have strong written and verbal communication skills, particularly during incidents.
• You are comfortable working cross-functionally and handling escalations calmly and decisively.

Who You Might Be (Nice-to-Haves)

• Experience securing financial, trading, or other highly regulated platforms.
• Familiarity with compliance frameworks such as SOC 2 or ISO 27001.
• Experience with just in time privileged access tools.
• Experience securing administrator access to SaaS platforms.
• Experience with password managers and secrets management at company scale.
• Experience with MDM platforms for macOS and Windows.
• Experience with cloud IAM in AWS, GCP, or Azure.
• The ability to balance security rigor with operational efficiency and business needs.

What We Offer

• Competitive Salary & Stock Options
• Health Benefits
• New Hire Home-Office Setup: One time USD $500
• Monthly Stipend: USD $150 per month via a Brex Card

Alpaca is proud to be an equal opportunity workplace dedicated to pursuing and hiring a diverse workforce.