Kubernetes Security Engineer – Platform Protection

SpaceXSI; Palo Alto, Austin, New York, Washington (CA, TX, NY, District of Columbia); On-site; USD 100,000 - 258,000; Full time

Benefits offered by this job

Equity

Medical, Vision & Dental coverage

401(k) retirement plan

Disability insurance

Job summary

SpaceXSI is seeking a Security Platform Engineer to protect the platform behind X and SpaceXSI’s services. You will identify risks, perform threat modeling, and implement durable fixes at scale across Kubernetes and cloud environments.

You will design and build security tooling, improve identity/secrets handling, and drive fleet-wide hardening with safe, constrained validation. Join a mission-driven team at SpaceXSI.

Qualifications

• 3+ years in platform security, Kubernetes security, or offensive security against production infrastructure.
• Deep knowledge of pod and workload security: privileged containers, capabilities, host namespaces, host path mounts, service accounts, RBAC, admission control, and network isolation.
• Working knowledge of identity, secrets, workload identity, service-to-service trust, supply chain, runtime, and cloud access.

Responsibilities

• Secure the platform end to end: nodes, clusters, pods, roles, tokens, secrets, service-to-service communication, and the supply chain.
• Find and remediate overprivileged permissions, dangerous pod and workload settings, and escalation paths in operators, admission, networking, identity, and monitoring.
• Assess our own platform the way an adversary would, including container and pod breakout, privilege escalation, and movement across workloads, using safe and constrained validation, then fix what you find.
• Design and build security tooling and automation, including AI-assisted analysis, that catches risky configuration and overprivilege before or after it ships.
• Strengthen identity and secrets handling so workloads receive only the access they need.
• Improve supply-chain security through secure base images, continuous scanning, and related controls.
• Review changes that affect RBAC, operators, ServiceAccounts, network policies, and anything running with elevated privileges.
• Partner with platform and product teams as a security owner, taking problems from identification through rollout.
• Contribute to fleet-wide hardening, policy enforcement, and safer defaults.

Skills

Platform security

Kubernetes security

Offensive security

Identity & secrets

Go

Python

Rust

AI in security

Adversary simulation

Tools

Kyverno

OPA

GitOps

Job description

SpaceXSI is seeking a Security Platform Engineer to protect the platform behind X and SpaceXSI’s services. You will identify risks, perform threat modeling, and implement durable fixes at scale across Kubernetes and cloud environments.

You will design and build security tooling, improve identity/secrets handling, and drive fleet-wide hardening with safe, constrained validation. Join a mission-driven team at SpaceXSI.