SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 180,000 - 250,000 / annual
K2 Space is building the largest and highest-power satellites ever flown, backed by over $1 billion in total funding from leading investors including Altimeter Capital, ICONIQ, Kleiner Perkins, Lightspeed Venture Partners, Redpoint Ventures, and T. Rowe Price. The company has over $1 billion in signed contracts across commercial and US government customers and is mass-producing the highest-power satellite platforms ever built for missions from LEO to deep space. With multiple launches planned for 2027 and plans to scale to 100 satellites per year, K2 is a high-growth Series D company.
K2 is a target for sophisticated adversaries, from nation-state actors to criminal groups intent on stealing or disrupting the technology behind this new class of high-powered satellites. This Principal Security Engineer role owns detection and response for the corporate environment. You will run and mature the SIEM, build detections against real adversary tradecraft, triage alerts, and drive incidents from first signal through containment, eradication, and lessons learned. You will be deeply hands-on across identity, endpoints, SaaS, network, and cloud telemetry, closing visibility gaps rather than simply documenting them.
Key responsibilities include:
- Own day-to-day detection and response across the corporate environment, from alert triage and investigation through containment and remediation
- Administer and mature the SIEM, including log source onboarding, parsing and normalization, telemetry enrichment, rule tuning, and platform health, retention, and cost management
- Write, test, and maintain detection content mapped to MITRE ATT&CK using detection-as-code practices, including version control, peer review, and automated testing
- Act as incident commander for corporate security incidents, coordinating stakeholders and delivering timelines, root cause analysis, and post-incident follow-through
- Build response playbooks and automation across SOAR, scripting, and vendor APIs to reduce time to detect, triage, and contain
- Threat hunt proactively across endpoint, identity, SaaS, and cloud telemetry using threat intelligence and hypotheses about adversary behavior
- Run adversary emulation and purple team exercises to validate detection coverage, then close the gaps identified
This is a role for someone who thrives on real-world impact and operates with urgency when it counts. Every detection you write and every incident you shut down directly supports K2's ability to move fast, operate confidently, and deliver breakthrough satellite capabilities.
REQUIREMENTS:
The posting does not explicitly state years of experience or specific technical certifications required. However, the role clearly expects:
- Deep expertise in SIEM administration and detection engineering
- Hands-on proficiency across identity, endpoints, SaaS, network, and cloud security telemetry
- Experience with detection-as-code practices, version control, and peer review processes
- Incident response and incident command experience
- Familiarity with MITRE ATT&CK framework
- Experience with SOAR platforms, scripting, and vendor API integration
- Threat hunting and adversary emulation capabilities
- Ability to work in a fast-paced, high-stakes environment
EXPORT COMPLIANCE NOTE:
The person hired for this role will have access to information and items controlled by U.S. export control regulations, including ITAR. The candidate must either be a "U.S. person" as defined by 22 C.F.R. § 120.15 (U.S. citizens, lawful permanent residents, refugees/asylees, American Samoans) or otherwise eligible for a federally issued export control license.
