Sr. Security Engineer (Vulnerability Management)

SpaceX•Bastrop, TX

1d•Onsite

About The Position

SpaceX is seeking a Senior Security Engineer to join Information Security and help protect the company’s systems, processes, and mission. As a member of the Vulnerability Management team, this engineer will partner with application software development teams to identify, assess, and remediate vulnerabilities and threats while developing and maintaining internal security tools. The work includes triaging bug reports, conducting Purple and Red Team activities, and continuous threat hunting. The position requires strong communication skills and the ability to turn technical findings into practical, actionable guidance. The role is onsite; hybrid and remote work will not be considered. The employee must be willing to work extended hours and/or weekends as needed, have a valid driver’s license, and be able to pass an Air Force background check for Cape Canaveral. ITAR-related eligibility requirements apply.

Requirements

Bachelor’s degree in computer science or another STEM discipline, or 2+ years of professional experience operating production infrastructure and a high school diploma or equivalency certificate in lieu of a degree.
5+ years of experience operating on-premises Kubernetes in a production environment.
5+ years of experience with Linux system administration and Python, Go, or another language used to automate infrastructure.
Must be willing to work extended hours and/or weekends as needed.
Must be able to work onsite; hybrid or remote work will not be considered.
Must have a valid driver’s license.
Must be able to pass an Air Force background check for Cape Canaveral.
Must meet the stated ITAR eligibility requirements or be eligible to obtain required U.S. Department of State authorizations.

Nice To Haves

Experience identifying, assessing, and remediating application, infrastructure, or cloud vulnerabilities.
Experience working directly with engineering teams to close findings.
Scripting or automation experience with Python, Bash, PowerShell, or similar, and ability to develop internal tools.
Strong understanding of networking fundamentals, including TCP/IP, DNS, HTTP/S, and firewalls, and how they relate to vulnerability exposure.
Reverse engineering or vulnerability development experience.
Experience triaging or working reports from bug bounty platforms such as Bugcrowd or HackerOne.
Hands-on participation in Purple Team or Red Team exercises.
OT Security experience.
Experience with continuous threat assessment, threat intelligence, or risk-based vulnerability prioritization.
Experience developing internal security tools, dashboards, or automation pipelines, including production-quality code and integrations.
Experience with web application testing frameworks and tools.
Experience performing software code reviews for security issues.
Experience improving developer experience around security tooling and processes.
Knowledge of network segmentation principles and implementation.
Experience with asset discovery or inventory processes.
Experience building or operating emerging vulnerability notification or alerting workflows.
Familiarity with AI/LLMs and MCPs.
Familiarity with cloud environments such as AWS, Azure, or GCP and their native security and vulnerability features.
Experience with configuration management, patching, or infrastructure-as-code.
Knowledge of threat modeling, risk scoring such as CVSS, and prioritization frameworks.
Familiarity with enterprise security controls and best practices for Windows, Linux, and macOS.
Strong communication skills, including the ability to translate technical findings into business impact and concrete remediation steps.
Relevant certifications such as OSCP or GSEC, or demonstrated equivalent experience.
Demonstrable problem-solving skills and ability to quickly determine root causes of issues.

Responsibilities

Develop tools, processes, and guidance that make security easier to adopt without slowing delivery.
Conduct software code reviews to identify insecure patterns and help teams remediate issues.
Perform web application security testing using established frameworks and tools.
Triage and validate Bugcrowd reports, coordinate with researchers, and work with internal teams on remediation and disclosure.
Perform Purple Team exercises to test controls, improve detection, and close identified gaps.
Contribute to Red Team operations or simulations, including scoping, execution support, and post-exercise analysis.
Build and operate emerging vulnerability communication processes so teams receive timely, actionable alerts on new threats.
Conduct continuous threat assessment by incorporating threat intelligence, emerging vulnerabilities, and attack trends into scanning coverage, notifications, and prioritization.
Partner with security sub-teams, including detection and response, compliance, application security, and infrastructure, to keep efforts consistent and reduce duplication.
Escalate critical or time-sensitive issues promptly and offer practical mitigation options.
Document findings, produce metrics, and provide regular risk summaries to leadership.