Infrastructure Security Engineer (Bare Metal & Platform)

Cybersecurity Jobs; Palo Alto (CA); On-site; USD 100,000 - 258,000; Full time

Benefits offered by this job

Equity

401(k) retirement plan

Disability insurance

Life insurance

Other discounts and perks

Job summary

SpaceXSI is building and securing infrastructure from bare metal to platform and application workloads. This Infrastructure Security Engineer role is hands‑on and operational, focusing on hardening physical and private‑cloud foundations, enforcing security controls for containers and Kubernetes, and running detection and response across hybrid environments.

This position is based in Palo Alto, CA (onsite) and supports security programs across firmware posture, provisioning, and infrastructure

Qualifications

• Bachelor's degree in Computer Science, Cybersecurity, or related field.
• 3–5 years of hands‑on infrastructure security experience.
• Proven experience securing bare‑metal, data‑center, or private‑cloud environments.

Responsibilities

• Design secure bare‑metal and private‑cloud architectures with firmware posture.
• Harden OS with CIS benchmarks, patching, and secure boot measures.
• Secure container and Kubernetes standards on bare metal and private cloud.
• Own hybrid connectivity including VPNs and direct connections.
• Manage identities across AD/LDAP and cloud IAM; federations and PAM.

Skills

Ownership

Critical thinking

Problem-solving

Collaboration

Education

Bachelor's degree in Computer Science, Cybersecurity

Tools

Puppet

Terraform

Kubernetes

CI/CD

Active Directory/LDAP

Job description

SpaceXSI is building and securing infrastructure across the full path from bare metal through platform and into application workloads. This Infrastructure Security Engineer role is hands‑on and operational, focused on hardening physical and private‑cloud foundations, enforcing security controls for containers and Kubernetes, and running detection and response capabilities across hybrid environments.

This position is based in Palo Alto, CA (onsite) and supports security programs spanning firmware posture, provisioning, network foundations, identity and privileged access, and infrastructure compliance across regulated frameworks.

Responsibilities

• Design and implement secure bare‑metal and private‑cloud architectures, including servers, storage, out‑of‑band management, and BIOS/UEFI/BMC firmware posture
• Harden physical and virtual fleets with OS baselines for Linux and Windows, CIS benchmarks, patch and vulnerability management, and secure boot or measured boot where applicable
• Perform hands‑on firmware and hardware lifecycle security using BMC/iDRAC/iLO, and support PXE/Kickstart provisioning
• Build and secure network foundations on real hardware, including segmentation, load balancers, DNS, PKI, NAC, and IDS/IPS
• Own hybrid connectivity between on‑premises and cloud, covering site‑to‑site VPN, Direct Connect/Interconnect/ExpressRoute, SD‑WAN, and zero‑trust access
• Manage identities and privileged access across Active Directory / LDAP / Kerberos and cloud IAM, including federation, SAML/OIDC, and PAM
• Support security assessments and audits across physical, on‑premises, and hybrid infrastructure
• Monitor and remediate infrastructure to align with regulations and best practices such as PCI, NIST CSF, GDPR, and HIPAA
• Design and implement secure container and Kubernetes standards on bare metal and private cloud, including RBAC, network policy, and secrets (not limited to managed EKS/GKE/AKS)
• Develop and maintain Infrastructure as Code and configuration management with embedded security controls, with emphasis on Puppet
• Collaborate with development teams to integrate security best practices into CI/CD pipelines
• Secure and enhance CI/CD pipelines, including integration and maintenance of code and image scanning platforms
• Monitor and respond to security events across bare metal, network devices, hosts, and hybrid cloud
• Maintain SIEM data pipelines that ingest on‑premises network, host, and cloud telemetry for reliable alerting
• Build, deploy, and maintain security operations infrastructure using Python, Terraform, and Puppet
• Create dashboards and alerts from security metrics spanning physical and platform layers
• Develop and maintain infrastructure security policies, standards, and procedures from metal through platform
• Own security projects end to end by identifying issues and implementing solutions
• Stay current on emerging threats and mitigations for bare‑metal, firmware, network, and hybrid‑cloud infrastructure

Requirements

• Bachelor's degree in Computer Science, Cybersecurity, or a related field
• 3–5 years of experience in infrastructure security, platform security, or related hands‑on roles
• Proven experience securing bare-metal, data‑center, or private‑cloud environments (not cloud‑only resumes)
• Hands‑on experience with firmware, BMC/iDRAC/iLO, PXE/Kickstart provisioning, and hardware lifecycle security
• Strong proficiency with Puppet for configuration management and fleet hardening in production
• Strong understanding of network security concepts and protocols, including hands‑on experience with firewalls, segmentation, and hybrid connectivity
• Experience with hybrid identity using AD/LDAP or similar integrated or federated with cloud IAM
• Experience applying Infrastructure as Code (for example, Terraform) to physical or VM fleets
• Familiarity with containerization and Kubernetes security implications, including on‑premises or bare‑metal clusters
• Experience with languages such as Python, Bash, and Golang for automation and tool development
• Familiarity with regulatory compliance requirements including GDPR, HIPAA, PCI DSS, and NIST CSF
• Experience in banking, money transmission, P2P payments, or similarly regulated financial platforms
• Proactive mindset with strong ownership, critical thinking, and problem‑solving skills
• Located in the SF Bay Area, Austin, New York, Palo Alto, or Seattle, or willing to relocate to a US office

Technologies

• Linux, Windows, BIOS/UEFI, BMC, iDRAC, iLO, PXE, Kickstart
• CIS benchmarks, Secure boot, Measured boot, DNS, PKI, NAC, IDS/IPS
• Site‑to‑site VPN, Direct Connect, Interconnect, ExpressRoute, SD‑WAN, zero‑trust access
• Active Directory, LDAP, Kerberos, SAML/OIDC, PAM
• Kubernetes, RBAC, network policy, secrets, Docker
• Infrastructure as Code, Puppet, CI/CD, Python, Terraform, GitHub Actions
• SIEM, Prometheus, Grafana, CloudWatch, Wazuh
• EKS, GKE, AKS, OpenStack, Proxmox, VMware, Nutanix, vSphere
• Compliance frameworks: NIST CSF, PCI, GDPR, HIPAA

Benefits

• Equity
• Comprehensive medical, vision, and dental coverage
• Access to a 401(k) retirement plan
• Short & long‑term disability insurance
• Life insurance
• Various other discounts and perks
• $100,000 - $258,000 USD