Security Engineer - Kubernetes

SECURITY ENGINEER, KUBERNETES

We protect the platform that runs X and SpaceXSI. We don’t just report issues, we actively look for real risks and exploits in our Kubernetes environments and turn them into durable fixes and tooling. You will secure the platform behind X and SpaceXSI’s infrastructure, products, and workloads. If you know pod and platform security, think in attack paths, and want to build the defenses that make the platform safer at scale, we want to hear from you.

We value a understanding of how Kubernetes can actually be abused – not just how it is configured. We prioritize shipping practical controls and tooling over writing policy documents, applying least privilege and defense-in-depth at fleet scale, delivering clear findings and fixes that platform teams can act on, and conducting safe, constrained validation that does not put production at risk.

RESPONSIBILITIES:

• Secure the platform end to end: nodes, clusters, pods, roles, tokens, secrets, service-to-service communication, and the supply chain
• Find and remediate overprivileged permissions, dangerous pod and workload settings, and escalation paths in operators, admission, networking, identity, and monitoring
• Assess our own platform the way an adversary would, including container and pod breakout, privilege escalation, and movement across workloads, using safe and constrained validation, then fix what you find
• Design and build security tooling and automation, including AI-assisted analysis, that catches risky configuration and overprivilege before or after it ships
• Strengthen identity and secrets handling so workloads receive only the access they need
• Improve supply-chain security through secure base images, continuous scanning, and related controls
• Review changes that affect RBAC, operators, ServiceAccounts, network policies, and anything running with elevated privileges
• Partner with platform and product teams as a security owner, taking problems from identification through rollout
• Contribute to fleet-wide hardening, policy enforcement, and safer defaults

BASIC QUALIFICATIONS:

• 3+ years in platform security, Kubernetes security, or offensive security against production infrastructure

PREFERRED SKILLS AND EXPERIENCE:

• Deep knowledge of pod and workload security: privileged containers, capabilities, host namespaces, host path mounts, service accounts, RBAC, admission control, and network isolation
• Working knowledge of identity, secrets, workload identity, service-to-service trust, supply chain, runtime, and cloud access
• Able to think like an attacker, measure blast radius, and turn the path into a detection, control, or tool
• Comfortable with operators, custom resources, Helm, and GitOps workflows
• Able to build or modify security tooling in Go, Python, or Rust when a control needs automation
• Bonus: Image scanning, SBOMs, secure base images, policy-as-code (Kyverno, OPA), multi-cluster environments, runtime detection, and security testing of customer-facing application
• Experience developing AI-driven security tools or integrating AI into security workflows
• Familiarity with Kubernetes-based environments and securing cloud-native infrastructure
• Proven ability to drive technical decisions and influence security practices across teams
• A passion for challenging the status quo and building transformative security solutions
• Strong collaboration skills, with experience working in dynamic, cross-functional teams
• A sense of humor and adaptability to thrive in a fast-paced, mission-driven environment

ADDITIONAL REQUIREMENTS:

• Open to working out of one of our offices: Palo Alto, Austin, DC, or New York

COMPENSATION AND BENEFITS:

$100,000 - $198,000 USD

Base salary is just one part of our total rewards package at SpaceXSI, which also includes equity, comprehensive medical, vision, and dental coverage, access to a 401(k) retirement plan, short & long-term disability insurance, life insurance, and various other discounts and perks.

ITAR REQUIREMENTS:

• To conform to U.S. Government export regulations, applicant must be a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (aka green card holder), (iii) Refugee under 8 U.S.C. § 1157, or (iv) Asylee under 8 U.S.C. § 1158, or be eligible to obtain the required authorizations from the U.S. Department of State. Learn more about the ITAR here.