Jobs / SpaceXSI
Security Engineer, Kubernetes
SpaceXSI · Palo Alto, CA, United States
Palo Alto, CA, United StatesExp: 3+ yrs100,000-258,000 USD/yearlyOnsite
Remuneration
$100,000 - $258,000 USD base salary, plus equity, medical, vision and dental coverage, a 401(k) plan, disability and life insurance, discounts, and other perks
Location
Palo Alto, CA, United States
Visa sponsorship
Not specified
Job summary
Secures the Kubernetes platform supporting infrastructure, products, and workloads by identifying exploitable risks and delivering durable fixes, controls, and tooling. The role covers cluster and pod security, identity and secrets, RBAC, workload isolation, and software supply-chain defenses, including safe adversarial testing and security automation using Go, Python, or Rust. It also partners with platform and product teams to roll out fleet-wide hardening and safer defaults.
Benefits
EquityMedical, vision, and dental coverage401(k) retirement planShort- and long-term disability insuranceLife insuranceDiscounts and other perks
Qualifications
- At least 3 years of experience in platform security, Kubernetes security, or offensive security against production infrastructure.
- Deep knowledge of pod and workload security, including privileged containers, capabilities, host namespaces, hostPath mounts, service accounts, RBAC, admission control, and network isolation.
- Working knowledge of identity, secrets, workload identity, service-to-service trust, software supply chains, runtime security, and cloud access.
- Ability to think like an attacker, assess blast radius, and turn attack paths into detections, controls, or tools.
- Experience with operators, custom resources, Helm, and GitOps workflows.
- Ability to build or modify security tooling in Go, Python, or Rust.
Responsibilities
- Secure nodes, clusters, pods, roles, tokens, secrets, service-to-service communication, and the software supply chain.
- Identify and remediate overprivileged permissions, unsafe workload settings, and escalation paths across operators, admission controls, networking, identity, and monitoring.
- Conduct safe adversarial testing for container and pod breakouts, privilege escalation, and movement between workloads, then remediate findings.
- Build security tooling and automation, including AI-assisted analysis, to detect risky configurations and excessive privileges.
- Strengthen workload identity and secrets handling to enforce least privilege.
- Improve supply-chain security with secure base images, continuous scanning, and related controls.
- Review changes involving RBAC, operators, ServiceAccounts, network policies, and elevated privileges.
- Partner with platform and product teams to own security issues from discovery through rollout.
- Contribute to fleet-wide hardening, policy enforcement, and safer defaults.
Skills
GoHelmKubernetesKyvernoOpen Policy AgentPythonRustDocker
Relocation
No