Cybersecurity Engineer

WHY JOIN ALO?

Mindful movement. It’s at the core of why we do what we do at ALO—it’s our calling. Because mindful movement in the studio leads to better living. It changes who yogis are off the mat, making their lives and their communities better. That’s the real meaning of studio-to-street: taking the consciousness from practice on the mat and putting it into practice in life.

About the role

ALO is hiring a Cybersecurity Engineer to own identity and access management across our cloud. You will design, secure, and automate how people and systems authenticate and what they can reach, using Microsoft Entra as our IdP.

This is a hands-on engineering role. You will spend most of your time building and hardening controls, writing PowerShell automation, and partnering with IT, infrastructure, and application teams to make secure access the easiest path.

What you'll do

Identity Platform

• Engineer and maintain Entra ID, including Conditional Access, MFA and passwordless authentication, and authentication strength policies.
• Run Privileged Identity Management (PIM) for just-in-time admin access and drive least privilege across Entra and Azure roles.
• Build and tune joiner-mover-leaver lifecycle processes, group-based access, and Entra ID Governance access reviews and entitlement packages.
• Integrate SaaS and internal apps via SAML, OIDC, and SCIM provisioning, and manage app registrations, service principals, and managed identities.
• Monitor sign-in and audit logs and respond to identity risks surfaced by Entra ID Protection.

Security Service Edge

• Administer SWG, CASB, ZTNA (Private Access), and DLP policies, tying access decisions to Entra identity and group context.
• Help manage SWG, CASB, ZTNA (Private Access) configuration and policy rollout.
• Help investigate policy alerts and tune controls to cut noise without weakening protection.

Automation (PowerShell)

Automate identity operations with PowerShell and the Microsoft Graph PowerShell SDK: provisioning, bulk changes, access reporting, and stale-account cleanup.

Build repeatable, version-controlled scripts and runbooks (for example, Azure Automation) with logging, error handling, and least-privilege authentication.

Infrastructure access

Help manage privileged access to servers, databases, and Kubernetes through PAM, aligning roles with Entra groups and auditing session activity.

Across the program

Write and maintain IAM standards, runbooks, and architecture documentation.

Support audits and compliance requirements from our Governance, Risk, and Compliance team members.

Take part in incident response for identity-related events and contribute to an on-call rotation as needed.

Required qualifications

4+ years in security, identity, or systems engineering, with at least 2 years focused on IAM.

Deep, hands-on experience with Microsoft Entra ID: Conditional Access, MFA, PIM, app integrations, groups and roles, and administrative units.

Hands-on experience administering SWG, CASB, ZTNA, or DLP, including identity-based policy design.

Strong PowerShell skills, including the Microsoft Graph PowerShell SDK; you can share examples of automation you have built and maintained in production.

Solid grasp of identity protocols and concepts: SAML, OAuth 2.0, OIDC, SCIM, Kerberos, RBAC, least privilege, and zero trust.

Working knowledge of Active Directory and Azure.

Clear written communication and the ability to explain access decisions to both engineers and non-technical stakeholders.

The base salary range for this position is $80,000-$90,000 per year which represents the current range for the base salary for this exempt position. Please note that actual salaries will vary based on factors including but not limited to location, experience, and performance. As such, on occasion and when applicable, there is the possibility that the final, agreed-upon base salary may be outside of the upper end of the range. Please also note the range listed is just one component of the company’s total rewards package for exempt employees. Other rewards may include performance bonuses, long term incentives, a PTO policy, and many other progressive benefits.

For CA residents, Job Applicant Privacy Policy HERE.