K2 Space
Acton, California
Job Description Job Description K2 is building the largest and highest-power satellites ever flown, unlocking performance levels previously out of reach across every orbit. Backed by over $1 billion in total funding from leading investors including Altimeter Capital, ICONIQ, Kleiner Perkins, Lightspeed Venture Partners, Redpoint Ventures, and T. Rowe Price - and with over $1 billion in signed contracts across commercial and US government customers, we're mass-producing the highest-power satellite platforms ever built for missions from LEO to deep space. The rise of heavy-lift launch vehicles is shifting the industry from an era of mass constraint to one of mass abundance, and we believe this new era demands a fundamentally different class of spacecraft. Engineered to survive the harshest radiation environments and to fully capitalize on today's and tomorrow's massive rockets, K2 satellites deliver unmatched capability at constellation scale and across multiple orbits. With multiple launches in 2027 and plans to scale to 100 satellites a year, we're Building Bigger - helping develop the solar system and build toward a Kardashev Type II (K2) civilization. If you are a motivated individual who thrives in a fast-paced environment and you're excited about contributing to the success of a high-growth Series D-funded company, we'd love for you to apply. The Role As K2's Crypto Engineer, you will own the architecture and design of our Type-1 cryptographic integrations across the spacecraft and ground segment. You will carry these designs cradle-to-grave - from concept and trade studies, through implementation and integration, to NSA certification and accreditation, and into on-orbit operations. You'll define how K2's satellites protect command, telemetry, and mission data; partner with NSA, government customers, and certification authorities; and ensure our COMSEC architecture meets the bar for national-security missions while fitting the pace and scale of a high-volume satellite production line. This is a foundational role: you'll set the cryptographic standards the rest of the program builds against. Responsibilities Own the end-to-end architecture and design of Type-1 cryptographic integrations across the spacecraft, payload, and ground segment Lead crypto designs from concept and trade studies through implementation, integration, certification, and on-orbit operations Define COMSEC architecture for command, telemetry, and mission data protection, including encryption, key management, and key loading approaches Serve as K2's primary technical interface to NSA, certification authorities, and government customers on cryptographic certification and accreditation Drive the certification and accreditation effort, developing the artifacts, test evidence, and documentation required to achieve and maintain approval to operate Partner with flight software, avionics, RF, ground, and security teams to integrate cryptographic functions into the broader system architecture Support COMSEC handling, key management planning, and operational procedures for on-orbit fleet operations Identify and mitigate cryptographic and supply-chain risks across design and production Establish reusable cryptographic standards, interfaces, and processes that scale across K2's satellite production line Qualifications Bachelor's degree or higher in electrical engineering, computer engineering, computer science, or a related discipline 5+ years of engineering experience with cryptographic systems, COMSEC, or secure communications Direct experience with NSA Type-1 cryptographic equipment, integration, and certification processes Working knowledge of key management, key loading, and COMSEC handling requirements Experience taking a hardware or system design through certification and accreditation to operational use Strong systems-level thinking with the ability to reason from first principles across hardware, software, and RF boundaries Ability to work in a fast-paced, autonomously driven, and demanding startup atmosphere with competing priorities and aggressive schedules Nice to Have Experience with spacecraft, satellite, or other space-system cryptographic integrations Familiarity with cryptographic modernization initiatives and current NSA-approved algorithms and equipment Experience with RMF/ATO, JSIG, or other accreditation frameworks Background in RF, link design, or secure command and telemetry systems Experience supporting on-orbit or fielded operations Additional Requirements Ability to travel up to 25% of the time Active Top Secret or Top Secret SCI clearance required; ability to obtain and maintain access to additional programs as needed Ability to work irregular business hours to support critical project timelines or operations This role requires access to information controlled under ITAR/EAR; applicants must be a U.S. Person as defined by applicable regulations Compensation and Benefits Base salary range for this role is $160,000 - $245,000 + equity in the company Salary will be based on several factors including, but not limited to: knowledge and skills, education, and experience level Comprehensive benefits package including paid time off, medical/dental/vision coverage, life insurance, paid parental leave, and many other perks If you don't meet 100% of the preferred skills and experience, we encourage you to still apply! Building a spacecraft unlike any other requires a team unlike any other and non-traditional career twists and turns are encouraged! If you need a reasonable accommodation as part of your application for employment or interviews with us, please let us know. Export Compliance As defined in the ITAR, "U.S. Persons" include U.S. citizens, lawful permanent residents (i.e., Green Card holders), and certain protected individuals (e.g., refugees/asylees, American Samoans). Please consult with a knowledgeable advisor if you are unsure whether you are a "U.S. Person." The person hired for this role will have access to information and items controlled by U.S. export control regulations, including the export control regulations outlined in the International Traffic in Arms Regulation (ITAR). The person hired for this role must therefore either be a "U.S. person" as defined by 22 C.F.R. 120.15 or otherwise eligible for a federally issued export control license. Equal Opportunity K2 Space is an Equal Opportunity Employer; employment with K2 Space is governed on the basis of merit, competence and qualifications and will not be influenced in any manner by race, color, religion, gender, national origin/ethnicity, veteran status, disability status, age, sexual orientation, gender identity, marital status, mental or physical disability or any other legally protected status.
Job Description Job Description K2 is building the largest and highest-power satellites ever flown, unlocking performance levels previously out of reach across every orbit. Backed by over $1 billion in total funding from leading investors including Altimeter Capital, ICONIQ, Kleiner Perkins, Lightspeed Venture Partners, Redpoint Ventures, and T. Rowe Price - and with over $1 billion in signed contracts across commercial and US government customers, we're mass-producing the highest-power satellite platforms ever built for missions from LEO to deep space. The rise of heavy-lift launch vehicles is shifting the industry from an era of mass constraint to one of mass abundance, and we believe this new era demands a fundamentally different class of spacecraft. Engineered to survive the harshest radiation environments and to fully capitalize on today's and tomorrow's massive rockets, K2 satellites deliver unmatched capability at constellation scale and across multiple orbits. With multiple launches in 2027 and plans to scale to 100 satellites a year, we're Building Bigger - helping develop the solar system and build toward a Kardashev Type II (K2) civilization. If you are a motivated individual who thrives in a fast-paced environment and you're excited about contributing to the success of a high-growth Series D-funded company, we'd love for you to apply. The Role As K2's Crypto Engineer, you will own the architecture and design of our Type-1 cryptographic integrations across the spacecraft and ground segment. You will carry these designs cradle-to-grave - from concept and trade studies, through implementation and integration, to NSA certification and accreditation, and into on-orbit operations. You'll define how K2's satellites protect command, telemetry, and mission data; partner with NSA, government customers, and certification authorities; and ensure our COMSEC architecture meets the bar for national-security missions while fitting the pace and scale of a high-volume satellite production line. This is a foundational role: you'll set the cryptographic standards the rest of the program builds against. Responsibilities Own the end-to-end architecture and design of Type-1 cryptographic integrations across the spacecraft, payload, and ground segment Lead crypto designs from concept and trade studies through implementation, integration, certification, and on-orbit operations Define COMSEC architecture for command, telemetry, and mission data protection, including encryption, key management, and key loading approaches Serve as K2's primary technical interface to NSA, certification authorities, and government customers on cryptographic certification and accreditation Drive the certification and accreditation effort, developing the artifacts, test evidence, and documentation required to achieve and maintain approval to operate Partner with flight software, avionics, RF, ground, and security teams to integrate cryptographic functions into the broader system architecture Support COMSEC handling, key management planning, and operational procedures for on-orbit fleet operations Identify and mitigate cryptographic and supply-chain risks across design and production Establish reusable cryptographic standards, interfaces, and processes that scale across K2's satellite production line Qualifications Bachelor's degree or higher in electrical engineering, computer engineering, computer science, or a related discipline 5+ years of engineering experience with cryptographic systems, COMSEC, or secure communications Direct experience with NSA Type-1 cryptographic equipment, integration, and certification processes Working knowledge of key management, key loading, and COMSEC handling requirements Experience taking a hardware or system design through certification and accreditation to operational use Strong systems-level thinking with the ability to reason from first principles across hardware, software, and RF boundaries Ability to work in a fast-paced, autonomously driven, and demanding startup atmosphere with competing priorities and aggressive schedules Nice to Have Experience with spacecraft, satellite, or other space-system cryptographic integrations Familiarity with cryptographic modernization initiatives and current NSA-approved algorithms and equipment Experience with RMF/ATO, JSIG, or other accreditation frameworks Background in RF, link design, or secure command and telemetry systems Experience supporting on-orbit or fielded operations Additional Requirements Ability to travel up to 25% of the time Active Top Secret or Top Secret SCI clearance required; ability to obtain and maintain access to additional programs as needed Ability to work irregular business hours to support critical project timelines or operations This role requires access to information controlled under ITAR/EAR; applicants must be a U.S. Person as defined by applicable regulations Compensation and Benefits Base salary range for this role is $160,000 - $245,000 + equity in the company Salary will be based on several factors including, but not limited to: knowledge and skills, education, and experience level Comprehensive benefits package including paid time off, medical/dental/vision coverage, life insurance, paid parental leave, and many other perks If you don't meet 100% of the preferred skills and experience, we encourage you to still apply! Building a spacecraft unlike any other requires a team unlike any other and non-traditional career twists and turns are encouraged! If you need a reasonable accommodation as part of your application for employment or interviews with us, please let us know. Export Compliance As defined in the ITAR, "U.S. Persons" include U.S. citizens, lawful permanent residents (i.e., Green Card holders), and certain protected individuals (e.g., refugees/asylees, American Samoans). Please consult with a knowledgeable advisor if you are unsure whether you are a "U.S. Person." The person hired for this role will have access to information and items controlled by U.S. export control regulations, including the export control regulations outlined in the International Traffic in Arms Regulation (ITAR). The person hired for this role must therefore either be a "U.S. person" as defined by 22 C.F.R. 120.15 or otherwise eligible for a federally issued export control license. Equal Opportunity K2 Space is an Equal Opportunity Employer; employment with K2 Space is governed on the basis of merit, competence and qualifications and will not be influenced in any manner by race, color, religion, gender, national origin/ethnicity, veteran status, disability status, age, sexual orientation, gender identity, marital status, mental or physical disability or any other legally protected status.
Sungrow USA Corporation
Houston, Texas
Job Description Job Description About the Company : Sungrow North America is a leading provider of renewable energy solutions, specializing in the development and manufacturing of photovoltaic inverters and energy storage systems. The company offers a comprehensive range of products and services designed to optimize the performance and efficiency of solar power installations. Sungrow North America aims to provide sustainable and reliable energy solutions to meet the growing demand for clean power and is known for its commitment to innovation, high-quality standards, and exceptional customer service. Security Engineer - Network & Identity: The Security Engineer (Network & Identity) is a hands-on engineering role within the IT team responsible for designing, implementing, securing, and automating Sungrow USA's network security, PKI and certificate management, and identity & access infrastructure across on-premises, cloud, and SaaS environments. This role serves as the technical owner for network security architecture, cryptographic services, certificate lifecycle management, authentication, and access controls. The position focuses on Zero Trust security, network segmentation, certificate-based authentication, and identity protection to reduce organizational risk and enable secure business operations and platform ownership rather than SOC operations, threat monitoring, or incident response. Essential Duties and Responsibilities: Network Security Design, implement, and maintain secure enterprise network architectures across corporate offices, data centers, cloud platforms, and remote workforce environments. Architect network segmentation, Zero Trust access controls, and secure connectivity standards using Fortinet and Zscaler security solutions. Develop and maintain Zero Trust architectures across network, identity, endpoint, application, and cloud environments. Design and administer secure remote access using Zscaler Private Access, VPN technologies, and identity-aware access controls. Manage firewall policies, network security controls, routing security, DNS security, and hybrid-cloud connectivity. Design and support Network Access Control architectures using IEEE 802.1X, RADIUS, and certificate-based authentication. Assess network security posture, develop remediation plans, and drive continuous security improvements. Cryptography, PKI & Certificate Management Own the enterprise PKI, cryptography, and certificate lifecycle management architecture, standards, and governance program. Design and manage certificate-based authentication and machine identity solutions for users, devices, servers, applications, cloud workloads, and network infrastructure across Azure, AWS, and hybrid environments. Implement and maintain certificate lifecycle automation using Microsoft Cloud PKI, Keyfactor, CyberArk Certificate Manager, EJBCA, DigiCert, AppViewX, or comparable platforms. Manage certificate issuance, enrollment, discovery, deployment, monitoring, renewal, revocation, auditing, and compliance across the enterprise. Design and support cryptographic services and certificate-based security controls, including TLS/mTLS, code signing, PKI trust hierarchies, certificate-based authentication, SCEP, PKCS, and machine identities. Establish PKI and cryptographic standards, key management practices, and security controls to support Zero Trust, regulatory compliance, and enterprise security requirements. Troubleshoot and resolve complex certificate, cryptographic, trust chain, authentication, and secure communications issues across enterprise systems and applications. Identity & Access Define authentication and authorization standards for workforce, partner, application, service, and machine identities. Design, implement, and maintain Microsoft Entra ID architecture, tenant governance, and identity security controls. Develop, test, and enforce Conditional Access policies and Zero Trust access controls. Implement and maintain MFA, passwordless authentication, phishing-resistant authentication, and Microsoft Entra ID Protection capabilities. Design and support enterprise SSO and federation integrations using SAML, OAuth 2.0, OpenID Connect, and SCIM. Implement least-privilege and risk-based access models across enterprise platforms. Administer RBAC, administrative separation, Microsoft Entra Privileged Identity Management, and least-privilege access controls. Govern application registrations, service principals, enterprise applications, API permissions, and managed identities. Support B2B collaboration, guest-user governance, external workforce access, and third-party identity integrations. Design and implement security controls across Microsoft Azure and AWS environments. Apply least privilege, RBAC, encryption, secrets management, and secure configuration standards to on-prem and cloud resources. Automate identity provisioning and deprovisioning, access governance, certificate management, configuration validation, and security operations. Create reusable secure-by-default templates and reduce manual administration through automation and orchestration Conduct access reviews, entitlement certifications, and identity governance activities. Education or Desired License and Certificates: Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Engineering, or a related field, or equivalent professional experience. Microsoft Certified: Identity and Access Administrator Associate (SC-300) preferred. Microsoft Certified: Azure Security Engineer Associate (AZ-500) preferred. CCNA, Fortinet, Zscaler, AWS Security, CISSP, CISM, Terraform, or relevant PKI certification preferred Preferred Experience & Qualifications: 5+ years of experience in security engineering, identity & access management (IAM), network security, cloud security, or a related enterprise IT discipline. Hands-on experience with Microsoft Entra ID, including Conditional Access, MFA, SSO, Identity Protection, PIM, RBAC, identity governance, and modern authentication protocols (SAML, OAuth, OpenID Connect, SCIM). Experience designing, implementing, and securing enterprise identity, privileged access, and machine identity solutions across hybrid and multi-cloud environments. Hands-on experience with Fortinet, Zscaler (ZIA/ZPA), Zero Trust architectures, least-privilege access models, and network security controls. Experience designing and operating enterprise PKI, certificate lifecycle management, certificate-based authentication, and machine identity platforms such as Keyfactor, DigiCert, EJBCA, AppViewX, CyberArk Certificate Manager, or similar solutions. Experience securing Azure and AWS environments, including identity, networking, encryption, secrets management, logging, and security monitoring. Experience with PAM and IGA platforms such as CyberArk, Delinea, BeyondTrust, SailPoint, Saviynt, or similar technologies. Experience integrating identity, network, cloud, and security telemetry with SIEM and security operations platforms. Strong automation and Infrastructure as Code skills using PowerShell, Python, Microsoft Graph API, REST APIs, Terraform, or similar technologies. Strong troubleshooting skills across authentication, federation, certificates, PKI, network security, cloud access, application integrations, and enterprise identity services. Knowledge of cybersecurity and compliance frameworks including SOC 2, ISO/IEC 27001, NIST CSF, NIST 800-63, CIS Controls, Zero Trust, and NERC CIP. Competencies: Mandarin fluency preferred but not required. Strong analytical, troubleshooting, and problem-solving skills. Ability to work independently and collaboratively in a fast-paced environment. Excellent communication, stakeholder management, and technical documentation skills. Strong organization, attention to detail, initiative, and ownership. Ability to balance security, reliability, usability, scalability, and business requirements. Proactive approach to automation, standardization, and continuous improvement. Travel 5%-20% Work Location and Status: Full time, Hybrid at any Sungrow USA office in Phoenix, Costa Mesa, or Houston No visa sponsorship Compensation: Compensation commensurate with experience Competitive salary and annual bonus eligibility Comprehensive benefits package including health, dental, vision, and retirement plans Strong personal and company growth opportunities Sungrow is an equal opportunity employer. Due to strong interest in this position, Sungrow will only reach out to those candidates who best meet the requirements. Thank you for your interest in Sungrow.
Job Description Job Description About the Company : Sungrow North America is a leading provider of renewable energy solutions, specializing in the development and manufacturing of photovoltaic inverters and energy storage systems. The company offers a comprehensive range of products and services designed to optimize the performance and efficiency of solar power installations. Sungrow North America aims to provide sustainable and reliable energy solutions to meet the growing demand for clean power and is known for its commitment to innovation, high-quality standards, and exceptional customer service. Security Engineer - Network & Identity: The Security Engineer (Network & Identity) is a hands-on engineering role within the IT team responsible for designing, implementing, securing, and automating Sungrow USA's network security, PKI and certificate management, and identity & access infrastructure across on-premises, cloud, and SaaS environments. This role serves as the technical owner for network security architecture, cryptographic services, certificate lifecycle management, authentication, and access controls. The position focuses on Zero Trust security, network segmentation, certificate-based authentication, and identity protection to reduce organizational risk and enable secure business operations and platform ownership rather than SOC operations, threat monitoring, or incident response. Essential Duties and Responsibilities: Network Security Design, implement, and maintain secure enterprise network architectures across corporate offices, data centers, cloud platforms, and remote workforce environments. Architect network segmentation, Zero Trust access controls, and secure connectivity standards using Fortinet and Zscaler security solutions. Develop and maintain Zero Trust architectures across network, identity, endpoint, application, and cloud environments. Design and administer secure remote access using Zscaler Private Access, VPN technologies, and identity-aware access controls. Manage firewall policies, network security controls, routing security, DNS security, and hybrid-cloud connectivity. Design and support Network Access Control architectures using IEEE 802.1X, RADIUS, and certificate-based authentication. Assess network security posture, develop remediation plans, and drive continuous security improvements. Cryptography, PKI & Certificate Management Own the enterprise PKI, cryptography, and certificate lifecycle management architecture, standards, and governance program. Design and manage certificate-based authentication and machine identity solutions for users, devices, servers, applications, cloud workloads, and network infrastructure across Azure, AWS, and hybrid environments. Implement and maintain certificate lifecycle automation using Microsoft Cloud PKI, Keyfactor, CyberArk Certificate Manager, EJBCA, DigiCert, AppViewX, or comparable platforms. Manage certificate issuance, enrollment, discovery, deployment, monitoring, renewal, revocation, auditing, and compliance across the enterprise. Design and support cryptographic services and certificate-based security controls, including TLS/mTLS, code signing, PKI trust hierarchies, certificate-based authentication, SCEP, PKCS, and machine identities. Establish PKI and cryptographic standards, key management practices, and security controls to support Zero Trust, regulatory compliance, and enterprise security requirements. Troubleshoot and resolve complex certificate, cryptographic, trust chain, authentication, and secure communications issues across enterprise systems and applications. Identity & Access Define authentication and authorization standards for workforce, partner, application, service, and machine identities. Design, implement, and maintain Microsoft Entra ID architecture, tenant governance, and identity security controls. Develop, test, and enforce Conditional Access policies and Zero Trust access controls. Implement and maintain MFA, passwordless authentication, phishing-resistant authentication, and Microsoft Entra ID Protection capabilities. Design and support enterprise SSO and federation integrations using SAML, OAuth 2.0, OpenID Connect, and SCIM. Implement least-privilege and risk-based access models across enterprise platforms. Administer RBAC, administrative separation, Microsoft Entra Privileged Identity Management, and least-privilege access controls. Govern application registrations, service principals, enterprise applications, API permissions, and managed identities. Support B2B collaboration, guest-user governance, external workforce access, and third-party identity integrations. Design and implement security controls across Microsoft Azure and AWS environments. Apply least privilege, RBAC, encryption, secrets management, and secure configuration standards to on-prem and cloud resources. Automate identity provisioning and deprovisioning, access governance, certificate management, configuration validation, and security operations. Create reusable secure-by-default templates and reduce manual administration through automation and orchestration Conduct access reviews, entitlement certifications, and identity governance activities. Education or Desired License and Certificates: Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Engineering, or a related field, or equivalent professional experience. Microsoft Certified: Identity and Access Administrator Associate (SC-300) preferred. Microsoft Certified: Azure Security Engineer Associate (AZ-500) preferred. CCNA, Fortinet, Zscaler, AWS Security, CISSP, CISM, Terraform, or relevant PKI certification preferred Preferred Experience & Qualifications: 5+ years of experience in security engineering, identity & access management (IAM), network security, cloud security, or a related enterprise IT discipline. Hands-on experience with Microsoft Entra ID, including Conditional Access, MFA, SSO, Identity Protection, PIM, RBAC, identity governance, and modern authentication protocols (SAML, OAuth, OpenID Connect, SCIM). Experience designing, implementing, and securing enterprise identity, privileged access, and machine identity solutions across hybrid and multi-cloud environments. Hands-on experience with Fortinet, Zscaler (ZIA/ZPA), Zero Trust architectures, least-privilege access models, and network security controls. Experience designing and operating enterprise PKI, certificate lifecycle management, certificate-based authentication, and machine identity platforms such as Keyfactor, DigiCert, EJBCA, AppViewX, CyberArk Certificate Manager, or similar solutions. Experience securing Azure and AWS environments, including identity, networking, encryption, secrets management, logging, and security monitoring. Experience with PAM and IGA platforms such as CyberArk, Delinea, BeyondTrust, SailPoint, Saviynt, or similar technologies. Experience integrating identity, network, cloud, and security telemetry with SIEM and security operations platforms. Strong automation and Infrastructure as Code skills using PowerShell, Python, Microsoft Graph API, REST APIs, Terraform, or similar technologies. Strong troubleshooting skills across authentication, federation, certificates, PKI, network security, cloud access, application integrations, and enterprise identity services. Knowledge of cybersecurity and compliance frameworks including SOC 2, ISO/IEC 27001, NIST CSF, NIST 800-63, CIS Controls, Zero Trust, and NERC CIP. Competencies: Mandarin fluency preferred but not required. Strong analytical, troubleshooting, and problem-solving skills. Ability to work independently and collaboratively in a fast-paced environment. Excellent communication, stakeholder management, and technical documentation skills. Strong organization, attention to detail, initiative, and ownership. Ability to balance security, reliability, usability, scalability, and business requirements. Proactive approach to automation, standardization, and continuous improvement. Travel 5%-20% Work Location and Status: Full time, Hybrid at any Sungrow USA office in Phoenix, Costa Mesa, or Houston No visa sponsorship Compensation: Compensation commensurate with experience Competitive salary and annual bonus eligibility Comprehensive benefits package including health, dental, vision, and retirement plans Strong personal and company growth opportunities Sungrow is an equal opportunity employer. Due to strong interest in this position, Sungrow will only reach out to those candidates who best meet the requirements. Thank you for your interest in Sungrow.