Principal Security Engineering

K2 is building the largest and highest-power satellites ever flown, unlocking performance levels previously out of reach across every orbit. Backed by over $1 billion in total funding from leading investors including Altimeter Capital, ICONIQ, Kleiner Perkins, Lightspeed Venture Partners, Redpoint Ventures, and T. Rowe Price — and with over $1 billion in signed contracts across commercial and US government customers, were mass-producing the highest-power satellite platforms ever built for missions from LEO to deep space.

The rise of heavy-lift launch vehicles is shifting the industry from an era of mass constraint to one of mass abundance, and we believe this new era demands a fundamentally different class of spacecraft. With multiple launches in 2027 and plans to scale to 100 satellites a year, were Building Bigger — helping develop the solar system and build toward a Kardashev Type II (K2) civilization. K2 is a target for sophisticated adversaries, from nation-state actors to criminal groups, all intent on stealing or disrupting the technology behind a new class of high-powered satellites. This role owns detection and response for our corporate environment: you’ll run and mature our SIEM, build detections against real adversary tradecraft, triage what fires, and drive incidents from first signal through containment, eradication, and lessons learned. You’ll be deeply hands-on across identity, endpoints, SaaS, network, and cloud telemetry, closing the visibility gaps you find rather than simply documenting them. Administer and mature the SIEM, including log source onboarding, parsing and normalization, telemetry enrichment, rule tuning, and platform health, retention, and cost

~ Write, test, and maintain detection content mapped to MITRE ATT&CK using detection-as-code practices, including version control, peer review, and automated testing

~ Act as incident commander for corporate security incidents, coordinating stakeholders and delivering timelines, root cause analysis, and post-incident follow-through

~ Threat hunt proactively across endpoint, identity, SaaS, and cloud telemetry using threat intelligence and hypotheses about adversary behavior

~ Perform host, network, and cloud forensics across macOS, Windows, and Linux to reconstruct attacker activity and scope impact

~ Investigate phishing, business email compromise, credential abuse, and insider risk in partnership with IT, HR, and Legal

~ Partner with IT and infrastructure teams to harden identity, endpoint, and network controls, including conditional access, EDR policy, MDM baselines, segmentation, and secure remote access, informed by what investigations reveal

~ Participate in an on-call rotation for security escalations, including occasional after-hours and weekend response

~ 10+ years of experience in security operations, detection and response, or incident response, preferably in a fast-paced startup or technology environment

~ Splunk, Microsoft Sentinel, Elastic, Panther, or Chronicle), including log source onboarding, parsing, and detection rule development

~ Experience investigating endpoint, identity, network, and cloud telemetry across macOS, Windows, and Linux, including EDR, identity provider, and SaaS audit logs

~2+ years of development experience with any modern programming language (including but not limited to Python, Go, C++, Rust) used to automate detection, enrichment, and response, in lieu of a degree; OR a bachelor’s degree in security engineering, cyber security, computer science, engineering, math, or other STEM discipline

~ Knowledge of operating systems, networking, cloud and SaaS platforms, security best practices, and log analysis at scale

~ Bachelor’s degree (or equivalent) in computer science or engineering

~ Experience building detection-as-code pipelines, security data lakes, or ETL for security telemetry

~ Experience with cloud detection and response in AWS, Azure, or GCP

~ Experience with threat intelligence, malware analysis, or reverse engineering

~ Experience protecting engineering, manufacturing, OT, or mission and ground segment environments

~ Security community contributions such as tooling, blog posts, conference talks, or CTFs

Base salary range for this role is $180,000 – $250,000 and equity in the company.

~ Comprehensive benefits package including paid time off, medical/dental/vision coverage, life insurance, paid parental leave, and many other perks.

Building a spacecraft unlike any other requires a team unlike any other and non-traditional career twists and turns are encouraged!
If you need a reasonable accommodation as part of your application for employment or interviews with us, please let us know.
S. citizens, lawful permanent residents (i.e., S. export control regulations, including the export control regulations outlined in the International Traffic in Arms Regulation (ITAR). employment with K2 Space is governed on the basis of merit, competence and qualifications and will not be influenced in any manner by race, color, religion, gender, national origin/ethnicity, veteran status, disability status, age, sexual orientation, gender identity, marital status, mental or physical disability or any other legally protected status.