Security engineer in corporate systems

Isomorphic Labs is applying frontier AI to help unlock deeper scientific insights, faster breakthroughs, and life-changing medicines with an ambition to solve all disease. The future is coming. A future enabled and enriched by the incredible power of machine learning. A future in which diseases are curtailed or cured starting with better and faster drug discovery.

• Design, optimize, and support corporate IAM structures, including group architectures, identity system integration, and streamlined employee onboarding/offboarding workflows.
• Audit corporate systems security and deploy/maintain a wide range of security tools (e.g., logging, monitoring & DLP, data labeling, AI agents).
• Collaborating with Corp Engineering, enhance data governance and security within corporate systems (Google Workspace, Confluence, Jira, Slack, etc.) by gathering user needs and co-developing scalable operating models, appropriate configurations, and SOPs.
• Partner closely with Detection & Response security engineers to improve and triage corporate security alerts, support incident response efforts when issues arise and address Google’ vulnerabilities and bugs.
• Promote corporate security rules, support security awareness training and run social engineering exercises.
• Collaborate with Workplace and Tech teams to ensure the security of physical systems (badges, lab workstations) and offices.
• Translate key user needs and security compliance requirements into clear operational processes—such as establishing workflows for onboarding new tools, setting up data transfers and external system integrations.
• Execute standardized vendor and software audits, improve SaaS Security Posture Management (SSPM) through tools, and address third-party integrations and supply-chain safety risks.
• Leverage AI tools and agentic workflows to automate routine security tasks, optimize triage, and streamline operations.
• Act as a positive, proactive point of contact for internal teams, delivering user-oriented security solutions that reduce friction while upholding high security standards.

• Fluency in navigating complex multi-org corporate systems’ workflows and processes.
• Experience with Atlassian’s and/or Google’s tech stacks.
• Proficiency in collecting user needs and business requirements, turning high-level guidance into efficient SOPs, policies, and guidelines documents.
• Strong foundation in Corporate Systems Security and IAM, including hands-on experience with SSO, user lifecycle management, and directory/group structures.
• Proficiency in basic Python, Go, or PowerShell to interface with REST APIs across SaaS ecosystems (Slack, Google Workspace, Okta).
• Knowledge of SaaS Security Posture Management (SSPM), and ideally, experience using tools like AppOmni, Adaptive Shield, or native SaaS log analysis to spot misconfigurations.
• Experience implementing Data Loss Prevention (DLP) corporate controls, data classification/labeling, and corporate data governance frameworks.
• Practical experience establishing or executing standardized vendor technical security assessments.
• Background in supporting security incident response and handling daily security alert triage.
• A strong bias for automation and an eagerness to leverage AI tools or agentic scanning mechanisms within corporate security workflows.
• Proactive, positive, and highly user-oriented mindset with exceptional communication skills to collaborate with technical and non-technical stakeholders alike.
• Будет плюсом: Experience in high-growth tech environments, BioTech, ML-centric companies, or the pharmaceutical industry; Familiarity with OWASP Top 10 for LLMs, prompt injection prevention, and secure integration of internal AI assistants; Hands-on experience building or integrating AI-driven automation, agentic workflows, or custom scripts for security operations; Understanding of security patterns for Electronic Lab Notebooks (ELNs), Laboratory Information Management Systems (LIMS), or High-Performance Computing (HPC) environments; Familiarity with GitHub Enterprise security settings, secret scanning, and developer environment hardening; Familiarity with common data protection regulations and security frameworks (e.g., GDPR, ISO 27001); Relevant industry certifications (e.g., Security+, CISSP, CISA, GSEC)

• This is why we follow a hybrid model, and would require you to be able to come into the office 3 days a week (currently Tuesday, Wednesday, and one other day depending on which team you’re in).