Security Engineer, Kubernetes

SpaceXSI•Washington, DC

3d•$100,000 - $258,000

About The Position

SpaceXSI is hiring a Security Engineer to protect the Kubernetes platform that runs X and SpaceXSI. The role focuses on finding real risks and exploit paths in Kubernetes environments and turning findings into durable fixes, security controls, and tooling. The engineer will secure the platform supporting infrastructure, products, and workloads, with an emphasis on practical defenses, least privilege, defense in depth, and safe validation that does not put production at risk. The role works with platform and product teams to identify and address security problems from discovery through rollout. It includes securing nodes, clusters, pods, identities, secrets, service-to-service communication, and the software supply chain; building automated security tools, including AI-assisted analysis; and contributing to fleet-wide hardening and safer defaults. The position is open to candidates working from one of the listed offices: Palo Alto, Austin, DC, or New York.

Requirements

At least 3 years of experience in platform security, Kubernetes security, or offensive security against production infrastructure.
Deep knowledge of pod and workload security, including privileged containers, capabilities, host namespaces, host path mounts, service accounts, RBAC, admission control, and network isolation.
Working knowledge of identity, secrets, workload identity, service-to-service trust, supply chain, runtime, and cloud access.
Ability to think like an attacker, measure blast radius, and turn attack paths into detections, controls, or tools.
Comfort with operators, custom resources, Helm, and GitOps workflows.
Ability to build or modify security tooling in Go, Python, or Rust when automation is needed.
Open to working from one of the offices in Palo Alto, Austin, DC, or New York.

Nice To Haves

Experience developing AI-driven security tools or integrating AI into security workflows.
Familiarity with Kubernetes-based environments and securing cloud-native infrastructure.
Proven ability to drive technical decisions and influence security practices across teams.
Passion for challenging the status quo and building transformative security solutions.
Strong collaboration skills and experience working in dynamic, cross-functional teams.
A sense of humor and adaptability in a fast-paced, mission-driven environment.
Experience with image scanning, SBOMs, secure base images, policy-as-code such as Kyverno or OPA, multi-cluster environments, runtime detection, or security testing of customer-facing applications.

Responsibilities

Secure nodes, clusters, pods, roles, tokens, secrets, service-to-service communication, and the supply chain.
Find and remediate overprivileged permissions, dangerous pod and workload settings, and escalation paths involving operators, admission, networking, identity, and monitoring.
Assess the platform from an adversarial perspective, including container and pod breakout, privilege escalation, and movement across workloads, using safe and constrained validation; remediate identified issues.
Design and build security tooling and automation, including AI-assisted analysis, to catch risky configuration and overprivilege before or after deployment.
Strengthen identity and secrets handling so workloads receive only the access they need.
Improve supply-chain security through secure base images, continuous scanning, and related controls.
Review changes affecting RBAC, operators, ServiceAccounts, network policies, and workloads running with elevated privileges.
Partner with platform and product teams as a security owner, taking problems from identification through rollout.
Contribute to fleet-wide hardening, policy enforcement, and safer defaults.