Infrastructure Security Engineer (Bare Metal & Platform)

SpaceXAI

Palo Alto (CA)

On-site

USD 100,000 - 258,000

Full time

14 days+

Get a reply from this employer

Your resume and cover letter, tailored to exactly what they’re hiring for.

Get past ATS filters

Benefits offered by this job

Equity

Medical/Vision/Dental coverage

401(k) retirement plan

Disability insurance

Life insurance

Employee discounts and perks

Job summary

SpaceXAI in Palo Alto is seeking an hands-on Infrastructure Security Engineer to design, build, and secure physical and private-cloud infrastructure through the platform and application stack. The role covers BIOS/UEFI, firmware posture, and Kubernetes security in hybrid environments.

You will own security across on-prem and cloud, automate with IaC, and drive compliance with PCI, NIST CSF, GDPR, and HIPAA.

Qualifications

Bachelor's degree in Computer Science, Cybersecurity, or a related field.
Hands-on experience securing bare-metal, data-center, or private-cloud environments (not cloud-only resumes).
Experience with firmware, BMC/iDRAC/iLO, PXE/Kickstart provisioning, and hardware lifecycle security.
Strong proficiency with Puppet for configuration management and fleet hardening in production.
Experience with hybrid identity (AD/LDAP) integrated with cloud IAM.
Experience with Infrastructure as Code (Terraform) on physical or VM fleets.
Familiarity with Kubernetes security implications, including on-premises or bare-metal clusters.
Proficiency in Python, Bash, and Golang for automation.
Familiarity with GDPR, HIPAA, PCI DSS, NIST CSF.

Responsibilities

Design and implement secure bare-metal and private-cloud architectures including servers, storage, and firmware posture.
Harden physical and virtual fleets with OS baselines and CIS benchmarks.
Manage firmware lifecycle security (BMC/iDRAC/iLO, PXE/Kickstart provisioning).
Build and secure network foundations on real hardware and hybrid connectivity.
Own security across on-premises and cloud, including VPNs and zero-trust patterns.
Monitor and respond to security events; maintain PCI/NIST CSF/GDPR/HIPAA compliance.
Develop IaC and configuration management with embedded security controls (Puppet, Terraform).
Integrate security into CI/CD pipelines and code/image scanning platforms.
Develop dashboards and alerts from security metrics across layers.

Skills

Infrastructure security

Bare-metal/private cloud security

Kubernetes security

Puppet

Terraform

Python

Golang

CI/CD security

Network security

Identity and access management

Hybrid cloud security

Education

Bachelor's degree

Tools

BMC/iDRAC/iLO

PXE/Kickstart

VMware/OpenStack/Proxmox

Prometheus/Grafana/CloudWatch

GitHub Actions

Job description

SpaceXAI is seeking a hands-on Infrastructure Security Engineer to build and secure infrastructure from bare metal through the platform and application stack. The role spans physical and private-cloud foundations, container and Kubernetes security standards, automation and tooling, and monitoring and incident response across hybrid environments.

Responsibilities

Design and implement secure bare-metal and private-cloud architectures including servers, storage, out-of-band management, and BIOS/UEFI/BMC firmware posture.
Harden physical and virtual fleets with OS baselines for Linux and Windows, CIS benchmarks, patch and vulnerability management, and secure boot or measured boot where applicable.
Perform hands-on work across firmware and hardware lifecycle security, including BMC and tools such as iDRAC/iLO, as well as PXE/Kickstart provisioning.
Build and secure network foundations on real hardware, including segmentation, load balancers, DNS, PKI, NAC, and IDS/IPS.
Own hybrid connectivity between on-premises and cloud, including site-to-site VPN, Direct Connect/Interconnect/ExpressRoute, SD-WAN, and zero-trust access patterns.
Manage identities and privileged access across Active Directory/LDAP/Kerberos and cloud IAM, including federation, SAML/OIDC, and PAM.
Assist with security assessments and audits spanning physical, on-premises, and hybrid infrastructure.
Monitor and remediate infrastructure to maintain compliance with regulations and best practices such as PCI, NIST CSF, GDPR, and HIPAA.
Design and implement secure container and Kubernetes standards for bare metal and private cloud, including RBAC, network policy, and secrets (not limited to managed Kubernetes services).
Develop and maintain Infrastructure as Code and configuration management with embedded security controls, with a focus on Puppet for physical and virtual fleets.
Collaborate with development teams to integrate security best practices into CI/CD pipelines.
Secure and enhance CI/CD pipelines by integrating and maintaining code and image scanning platforms.
Monitor and respond to security events and incidents across bare metal, network devices, hosts, and hybrid cloud.
Maintain SIEM data pipelines that ingest on-premises network, host, and cloud telemetry for reliable alerting.
Build, deploy, and maintain security operations infrastructure using Python, Terraform, and Puppet.
Create dashboards and alerts from security metrics across physical and platform layers.
Develop and maintain infrastructure security policies, standards, and procedures from metal through the platform.
Own security projects end to end, from identifying issues to implementing solutions.
Stay current on emerging threats and mitigations for bare-metal, firmware, network, and hybrid-cloud infrastructure.

Requirements

Bachelor's degree in Computer Science, Cybersecurity, or a related field.
3-5 years of experience in infrastructure security, platform security, or related hands-on roles.
Proven experience securing bare-metal, data-center, or private-cloud environments (not cloud-only resumes).
Hands-on experience with firmware, BMC/iDRAC/iLO, PXE/Kickstart provisioning, and hardware lifecycle security.
Strong proficiency with Puppet for configuration management and fleet hardening in production.
Strong understanding of network security, including hands-on work with firewalls, segmentation, and hybrid connectivity.
Experience with hybrid identity (AD/LDAP or similar) integrated or federated with cloud IAM.
Experience with Infrastructure as Code (e.g., Terraform) applied to physical or VM fleets.
Familiarity with containerization and Kubernetes security implications, including on-premises or bare-metal clusters.
Experience with automation and tool development using languages such as Python, Bash, and Golang.
Familiarity with regulatory compliance requirements including GDPR, HIPAA, PCI DSS, and NIST CSF.
Experience in banking, money transmission, P2P payments, or similarly regulated financial platforms.
Proactive mindset with strong ownership, critical thinking, and problem-solving skills.
Located in the SF Bay Area, Austin, New York, Palo Alto, or Seattle, or willing to relocate to a US office.

Technologies

Linux, Windows, BIOS/UEFI, BMC, iDRAC, iLO, PXE, Kickstart, CIS benchmarks, secure boot / measured boot, DNS, PKI, NAC, IDS/IPS, site-to-site VPN, Direct Connect / Interconnect / ExpressRoute, SD-WAN, Active Directory, LDAP, Kerberos, SAML/OIDC, PAM, Kubernetes, RBAC, network policy, secrets, Infrastructure as Code, Puppet, CI/CD pipelines, SIEM, Python, Terraform, Active Directory / LDAP / Kerberos, firewalls, Bash, Golang, EKS, GKE, AKS.

Preferred Skills and Experience

Deep expertise operating and securing physical server fleets, colo, or private cloud (VMware, OpenStack, Proxmox, Nutanix, or similar).
Relevant security certifications (e.g., CCSP, CSSK, OSCP, network or cloud security specialty).
Strong proficiency with Python and Terraform on production fleets.
Deep expertise in Kubernetes and container security on bare metal or private cloud.
Experience with multi-cloud and cloud-to-on-prem security.
Knowledge of CI/CD best practices and hands-on work with GitHub Actions or equivalent.
Experience with observability and security operations tooling (e.g., Prometheus, Grafana, CloudWatch, Karma; SIEM platforms such as Wazuh).
Experience building custom security tools or integrations.
Interest in leveraging AI for infrastructure security monitoring and automation.
Contributions to open-source infrastructure or security projects.
Experience securing AI/ML and GPU workloads on bare metal or hybrid infrastructure.