3+ years in platform security, Kubernetes security, or offensive security against production infrastructure
Deep knowledge of pod and workload security including RBAC and network isolation
Working knowledge of identity, secrets, and cloud access
Ability to think like an attacker and measure blast radius
Comfortable with operators, custom resources, and GitOps workflows
Proficient in building or modifying security tooling in Go, Python, or Rust
Bonus: Experience with image scanning and policy-as-code
Responsibilities
Secure the platform end to end, including nodes, clusters, and secrets
Find and remediate overprivileged permissions and dangerous settings
Assess the platform like an adversary, identifying vulnerabilities
Design and build security tooling and automation for risk detection
Strengthen identity and secrets handling for workload access
Improve supply-chain security through continuous scanning
Review changes affecting RBAC and elevated privileges
Partner with teams to identify and roll out security solutions
Benefits
Equity participation
Comprehensive medical, vision, and dental coverage
Access to a 401(k) retirement plan
Short & long-term disability insurance
Life insurance
Various discounts and perks
Full Job Description
ABOUT THE ROLE:
We protect the platform that runs X and SpaceXSI. We don't just report issues, we actively look for real risks and exploits in our Kubernetes environments and turn them into durable fixes and tooling. You will secure the platform behind X and SpaceXSI's infrastructure, products, and workloads. If you know pod and platform security, think in attack paths, and want to build the defenses that make the platform safer at scale, we want to hear from you.
We Value
Understanding how Kubernetes can actually be abused, not only how it is configured
Shipping practical controls and tooling over writing policy documents
Least privilege and defense-in-depth at fleet scale
Clear findings and fixes that platform teams can act on
Safe, constrained validation that does not put production at risk
RESPONSIBILITIES:
Secure the platform end to end: nodes, clusters, pods, roles, tokens, secrets, service-to-service communication, and the supply chain
Find and remediate overprivileged permissions, dangerous pod and workload settings, and escalation paths in operators, admission, networking, identity, and monitoring
Assess our own platform the way an adversary would, including container and pod breakout, privilege escalation, and movement across workloads, using safe and constrained validation, then fix what you find
Design and build security tooling and automation, including AI-assisted analysis, that catches risky configuration and overprivilege before or after it ships
Strengthen identity and secrets handling so workloads receive only the access they need
Improve supply-chain security through secure base images, continuous scanning, and related controls
Review changes that affect RBAC, operators, ServiceAccounts, network policies, and anything running with elevated privileges
Partner with platform and product teams as a security owner, taking problems from identification through rollout
Contribute to fleet-wide hardening, policy enforcement, and safer defaults
BASIC QUALIFICATIONS:
3+ years in platform security, Kubernetes security, or offensive security against production infrastructure
Deep knowledge of pod and workload security: privileged containers, capabilities, host namespaces, host path mounts, service accounts, RBAC, admission control, and network isolation
Working knowledge of identity, secrets, workload identity, service-to-service trust, supply chain, runtime, and cloud access
Able to think like an attacker, measure blast radius, and turn the path into a detection, control, or tool
Comfortable with operators, custom resources, Helm, and GitOps workflows
Able to build or modify security tooling in Go, Python, or Rust when a control needs automation
Bonus: Image scanning, SBOMs, secure base images, policy-as-code (Kyverno, OPA), multi-cluster environments, runtime detection, and security testing of customer-facing application
Open to working out of one of our offices: Palo Alto, Austin, DC, or New York.
PREFERRED SKILLS AND EXPERIENCE:
Experience developing AI-driven security tools or integrating AI into security workflows
Familiarity with Kubernetes-based environments and securing cloud-native infrastructure
Proven ability to drive technical decisions and influence security practices across teams
A passion for challenging the status quo and building transformative security solutions
Strong collaboration skills, with experience working in dynamic, cross-functional teams
A sense of humor and adaptability to thrive in a fast-paced, mission-driven environment
COMPENSATION AND BENEFITS:
$100,000 - $258,000 USD
Base salary is just one part of our total rewards package at SpaceXSI, which also includes equity, comprehensive medical, vision, and dental coverage, access to a 401(k) retirement plan, short & long-term disability insurance, life insurance, and various other discounts and perks.
