5 days ago
Responsibilities
- Develop security tools, processes, and guidance that enable engineering teams to adopt security practices.
- Conduct secure software code reviews and web application security testing.
- Triage and validate Bugcrowd reports and coordinate remediation and disclosure with researchers and internal teams.
- Perform Purple Team exercises, contribute to Red Team operations, and analyze post-exercise findings.
- Build vulnerability communication, threat assessment, notification, scanning, and prioritization processes.
- Partner with detection and response, compliance, application security, and infrastructure teams.
- Document findings, produce metrics, escalate critical issues, and provide risk summaries to leadership.
Requirements
- Bachelor's degree in computer science or another STEM discipline, or at least two years of professional production-infrastructure experience with a high school diploma or equivalency certificate.
- At least five years of experience operating on-premises Kubernetes in production.
- At least five years of Linux system administration experience and experience with Python, Go, or another infrastructure-automation language.
- Experience identifying, assessing, and remediating vulnerabilities and working directly with engineering teams.
- Experience with scripting and automation using Python, Bash, PowerShell, or similar tools.
- Understanding of TCP/IP, DNS, HTTP/S, firewalls, network segmentation, threat modeling, CVSS, and risk prioritization.
- Experience with reverse engineering, vulnerability development, bug bounty reports, Purple Team or Red Team exercises, threat intelligence, or risk-based vulnerability prioritization.
- Experience developing internal security tools, dashboards, automation pipelines, vulnerability-alerting workflows, or asset-discovery processes.
- Experience with web application testing, secure code reviews, developer security tooling, configuration management, patching, or infrastructure-as-code.
- Familiarity with AI/LLMs, MCPs, AWS, Azure, GCP, and security controls for Windows, Linux, and macOS.
- Relevant certifications such as OSCP or GSEC, or equivalent demonstrated experience.
- Strong communication, problem-solving, root-cause analysis, and ability to translate technical findings into business impact and remediation steps.
- Must be willing to work extended hours or weekends, hold a valid driver's license, and pass an Air Force background check for Cape Canaveral.
- Must satisfy applicable ITAR eligibility or obtain required U.S. Department of State authorizations.
Benefits
- The role is fully onsite; hybrid and remote work are not considered.
- Extended hours and weekend work may be required.
- Employment is subject to an Air Force background check for Cape Canaveral.
Tech Stack
Categories
About SpaceX
SpaceX designs, manufactures, and launches orbital rockets and spacecraft, and operates Starlink, a global satellite internet network for consumers, businesses, and governments. Its revenue comes from commercial and government launch services (Falcon 9/Falcon Heavy, Dragon cargo and crew to the ISS) and subscription broadband with Starlink hardware and service. Founded in 2002 and headquartered in Hawthorne, California, the privately held company serves NASA and commercial satellite operators, building most systems in-house.