Want to know if this job is worth applying to?
San Francisco, California, United States
Onsite
Not Available
Arena is the platform for evaluating how AI models perform in the real world. Founded by researchers from UC Berkeley's SkyLab, we're on a mission to measure and advance the frontier of AI for real-world use, and to build the foundation for everyone to understand, shape, and benefit from it.
Tens of millions of people use Arena each month to evaluate how frontier systems handle the work they actually do. The preferences they share power the most transparent, rigorous, and human-centered evaluations in AI. Leading AI labs, enterprises, and independent researchers rely on our work and open datasets to understand how models behave in real workflows: agentic coding, creative generation, professional productivity, and beyond. We go beyond leaderboards and decompose what human experience reveals about AI, so models advance toward the work people actually do.
We're a team of researchers, academics, builders, and creatives from UC Berkeley, Google, Stanford, and DeepMind. We seek truth, move fast, and value craftsmanship, curiosity, and impact over hierarchy. We're building a company where thoughtful, curious people from all backgrounds can do their best work together, in an office culture that radiates excellence, energy, and focus.
We are looking for a senior IT and security engineer to own that function's technical
direction. You will set how identity, endpoints, and access actually work here, decide what gets automated rather than done by hand, and be the person the team defers to on the hard calls.
This is a hands-on seat. You will do the work, not direct it from a distance.
You are not starting from zero. Identity is centralized with automated provisioning, the fleet is managed and enrolled with endpoint protection deployed, and remote access runs through a zero-trust layer. The foundations work. We need someone to deepen them, extend the model to areas it doesn't reach yet, and document what currently lives in people's heads.
The scope goes past enterprise systems. Our engineers build on source control, cloud data and analytics platforms, hosting, and managed infrastructure, and access to those carries
consequences that a wiki or a calendar does not. You will own how entitlement works there too.
This role is onsite in our San Francisco office.
Design the identity and access model, not just administer it. Okta is the center of gravity: SSO and SCIM, group and role design, lifecycle automation for joiners, movers, and leavers, and access reviews that produce evidence an auditor accepts. You decide what determines group membership and what the source of truth is.
Own endpoint strategy across a heavily Apple fleet. Intune, Apple Business Manager, and CrowdStrike Falcon: enrollment, compliance baselines, patching, and the full lifecycle from procurement to retirement.
Set the posture across enterprise and production systems. Enterprise platforms plus the developer and production systems our engineers depend on: source control, cloud data and analytics, hosting, and managed infrastructure. One standard applied across all of it, third-party application access, and a real answer for what an application can reach once authorized.
Extend the access model to production. Entitlement to developer and data platforms is a harder problem than enterprise SaaS: the blast radius is larger, the roles are less uniform, and the review evidence is what auditors scrutinize most. You own how that works.
Decide what stops being manual. Much of the current request queue is automatable, and nobody has had time. Okta Workflows, Google APIs, Python, PowerShell, or Bash- whatever fits.
Deepen operational readiness. An on-call rotation exists. Runbooks, escalation paths, and documentation are thinner than they should be, and much of the environment is still undocumented. You write it so a colleague can do the work without you.
Own onboarding and offboarding end to end, including the evidence trail compliance depends on.
Partner with the security function on device trust, conditional access, and privileged
access. This seat sits inside security rather than next to it.
Deep, current, hands-on experience. You can describe what you built or configured in the last three months at keyboard level.
You have owned a function, not just a queue. You have made architectural calls about how identity and endpoint management should work somewhere, defended them, and lived with what they cost. You can name one you got wrong and changed.
Real identity depth. Okta or comparable. You can explain what determines group membership, what happens to a mover rather than only a joiner and leaver, and how your model holds up as a company grows quickly.
Automation instinct. You can name a category of work that no longer exists because you eliminated it, and say what you deliberately left manual.
Endpoint management at scale across mixed platforms. Intune, Jamf, or equivalent, plus an endpoint security agent fleet.
Security depth for this domain. Least privilege, conditional access, device trust,
privileged access, and what an auditor will ask for.
Judgment about production and developer access, where over-granting is quietly expensive and under-granting stops engineers working. You have held that line somewhere.
Hands-on with AI tooling in your own work. You use AI to build, script, and troubleshoot, and you know where it belongs in an enterprise environment and where it doesn't.
Comfort inheriting something partly built and partly undocumented, and improving it rather than rebuilding it.
Calm under competing demands. You will support engineers, researchers, and executives, and need to tell a real emergency from a loud one.
Compliance evidence work: SOC 2 or ISO 27001 access reviews, asset inventory, offboarding records
Experience supporting a company through a period of rapid headcount growth
Zero-trust or conditional-access architecture
Governing AI tool adoption across a workforce: access, data handling, and sanctioned versus shadow usage
Cloudflare One administration and policy configuration
Hardware-key MFA rollouts (YubiKey, FIDO2)
AV, networking, or office buildout experience
Linux and cloud platforms (GCP, AWS, Azure)
We offer competitive compensation aligned to the markets where our team members are based. The compensation range for each role is listed on its posting and will depend on the candidate's experience and work location.
Comprehensive health and wellness benefits, including medical, dental, vision, and additional support programs.
The opportunity to work on cutting-edge AI with a small, mission-driven team
A culture that values transparency, trust, and community impact
Come help build the space where anyone can explore and help shape the future of AI.
Arena Intelligence provides equal employment opportunities (EEO) to all employees and applicants for employment without regard to race, color, religion, sex, national origin, age, disability, genetics, sexual orientation, gender identity, or gender expression. We are committed to a diverse and inclusive workforce and welcome people from all backgrounds, experiences, perspectives, and abilities.
