Enterprise Security Engineer, Benchling

• 5+ years in a security engineering or IAM-focused role
• Deep, hands-on IdP expertise (preferably Okta) — SSO, SCIM, MFA, Lifecycle Management, and NHI management are all areas you can speak to with depth and demonstrate in practice
• Demonstrated experience implementing zero trust architecture in practice — not just familiarity with the framework, but hands-on delivery of continuous verification, device trust integration, and least-privilege enforcement across an organization
• Strong working knowledge of identity protocols: SAML, OIDC, OAuth 2.0, and SCIM
• Proficiency managing macOS endpoints at scale using Fleet or an equivalent MDM platform
• Foundational cloud IAM experience across at least one major provider (AWS, GCP, or Azure) — enough to audit, scope, and remediate identity issues
• Demonstrated track record of building automation that eliminated recurring manual work
• Scripting proficiency in in at least one language, preferably Python
• Excellent communication skills, with the ability to engage effectively with both technical teams and non-technical stakeholders
• Strong understanding of operating systems fundamentals (MacOS/Linux/Windows)

Desirable

• As an Enterprise Security Engineer at Benchling you’ll be joining a team responsible for building a best-in-class security program from the ground up
• Our focus is on providing value to the organization by emphasizing real world security and embracing automation and AI
• We’re looking for engineers who are excited to apply their expertise to our mission of securing some of society's most sensitive data
• Drive the organization's zero trust strategy end to end — treating identity, device health, network context, and application sensitivity as continuous inputs to access decisions rather than one-time gates
• Design and maintain least-privilege access patterns, Just-in-Time (JIT) access, and Privileged Access Management (PAM) controls
• Deploy, configure, and maintain MDM infrastructure for the macOS fleet, ensuring device compliance feeds directly into zero trust access policy decisions
• Enforce SSO-required policies, review and restrict OAuth scopes, and audit third-party integration access
• Build processes and tooling to detect shadow IT, unauthorized OAuth app grants, and SaaS tools that bypass identity controls
• Evaluate and deploy AI-native security tooling where it demonstrably reduces analyst burden or closes coverage gaps faster than traditional approaches
• Define and enforce security standards for AI agent and LLM service identities — including scoped API keys, short-lived credentials, and workload identity federation
• Develop and enforce CIS/NIST-aligned configuration baselines
• Meaningfully reduce manual toil through automation and, where applicable, AI-assisted tooling