Senior Security Engineer - IAM

Company Overview: TENEX is an AI-native, automation-first, built-for-scale Managed Detection and Response (MDR) provider. We are a force multiplier for defenders, helping organizations enhance their cybersecurity posture through advanced threat detection, rapid response, and continuous protection. Our team is composed of industry experts with deep experience in cybersecurity, automation and AI-driven solutions. Backed by leading investors, we are rapidly growing and seeking top talent to join our mission of revolutionizing the AI-Native MDR landscape. We’re a fast growing startup backed by industry experts and top tier investors led by Crosspoint Capital Partners and also backed by Shield Capital, DTCP (formerly Deutsche Telekom Capital Partners), Deepwork Capital, and the Florida Opportunity Fund. Seed round led by Andreessen Horowitz (a16z). As an early employee, you’ll play a meaningful role in defining and building our culture. Get in on the ground floor. We’re a small but well-funded team that just raised a substantial round – joining now comes with limited risk and unlimited upside. Culture is one of the most important things at TENEX.AI —explore our culture deck at culture.tenex.ai to witness how we embody it, prioritizing the irreplaceable collaboration and community of in-person work. About the Opportunity: Almost every serious intrusion runs through identity at some point: a stolen token, an over-permissioned service principal, a trust relationship nobody remembered was there. It is also where defenders have the least margin for error, and where compliant and hard to attack are rarely the same thing. As Senior Security Engineer for IAM, you own that problem for TENEX and our customers. You will define what hardened identity actually looks like across Entra ID and Active Directory, Okta, and cloud IAM, take customer environments apart to find the paths an attacker would take, and back our SOC and incident responders when identity is in play. This is for someone who knows identity down to the protocol level, thinks in attack paths, and can sit across from a customer’s IAM architect and be the one who spots the risk they missed. What You’ll Do: Define what hardened identity looks like. Build and maintain the configuration and hardening standards for Entra ID and Active Directory, Okta, and cloud IAM, grounded in how these platforms actually get attacked rather than a generic checklist. Keep them current as the vendors ship changes and attackers find new paths. Reduce IAM risk for customers. Work through customer identity environments and map the attack paths: excessive privilege and shadow admin, weak or bypassable authentication, loose federation and trust, stale access, and the tier-0 exposure that turns one foothold into full tenant or domain compromise. Then drive the remediation that actually closes them. Work alongside customer identity teams. Sit across from client IAM engineers and architects as a peer, review their designs, and push back where the risk warrants it. Give clear, prioritized recommendations they can put into production. Advise the SOC and IR. Be the identity expert our analysts and responders reach for when something looks off: anomalous token use, a suspicious OAuth consent grant, a golden SAML, lateral movement across trust relationships. Help them scope identity-driven incidents fast and know what to pull and what to contain. Mature how the SOC handles identity. Assess how well the SOC can respond to and contain identity attacks today, then close the gaps: the detections that need to fire, the containment actions that should be fast and repeatable (revoking sessions and tokens, disabling accounts, killing malicious app grants, cutting an abused trust), and the playbooks that hold up under pressure. What You Bring: 7+ years deep in identity, hands-on across Entra ID and Active Directory, Okta, and cloud IAM (AWS, GCP, Azure), with real command of authentication, authorization, federation and trust, and privileged access. The attacker’s view of identity: how Kerberos, SAML, OAuth, and OIDC break in practice, and how a single foothold becomes privilege and then persistence. A track record of hardening real identity environments and getting the fixes shipped, not just writing up the gaps. The depth and credibility to be the authority on identity risk in any room, including across the table from a customer’s own IAM architects.