Security Engineer, Kubernetes

Details

The security team protects the platform that runs X and SpaceXSI. This role focuses on identifying risks and exploits in Kubernetes environments and developing durable fixes and tooling to secure the infrastructure, products, and workloads at scale.

Responsibilities

• Secure the platform end to end, including nodes, clusters, pods, roles, tokens, secrets, service-to-service communication, and the software supply chain.
• Find and remediate overprivileged permissions, dangerous pod and workload settings, and escalation paths in operators, admission, networking, identity, and monitoring.
• Assess the platform as an adversary would, including container and pod breakout, privilege escalation, and movement across workloads, using safe and constrained validation.
• Design and build security tooling and automation, including AI-assisted analysis, to detect risky configuration and overprivilege before or after deployment.
• Strengthen identity and secrets handling so workloads receive only the access they need.
• Improve supply-chain security through secure base images, continuous scanning, and related controls.
• Review changes affecting RBAC, operators, ServiceAccounts, network policies, and workloads running with elevated privileges.
• Partner with platform and product teams as a security owner, taking problems from identification through rollout.
• Contribute to fleet-wide hardening, policy enforcement, and safer defaults.

Requirements

• 3+ years of experience in platform security, Kubernetes security, or offensive security against production infrastructure.
• Deep knowledge of pod and workload security, including privileged containers, capabilities, host namespaces, host path mounts, service accounts, RBAC, admission control, and network isolation.
• Working knowledge of identity, secrets, workload identity, service-to-service trust, supply chain, runtime, and cloud access.
• Ability to think like an attacker, measure blast radius, and turn attack paths into detections, controls, or tools.
• Experience with operators, custom resources, Helm, and GitOps workflows.
• Ability to build or modify security tooling in Go, Python, or Rust when automation is required.
• Bonus experience with image scanning, SBOMs, secure base images, policy-as-code such as Kyverno and OPA, multi-cluster environments, runtime detection, and security testing of customer-facing applications.
• Experience developing AI-driven security tools or integrating AI into security workflows is preferred.
• Familiarity with Kubernetes-based environments and securing cloud-native infrastructure.
• Proven ability to drive technical decisions and influence security practices across teams.
• Strong collaboration skills and experience working in dynamic, cross-functional teams.
• Open to working from one of the company's offices in Palo Alto, Austin, Washington, DC, or New York City.

Benefits

• Equity.
• Comprehensive medical, vision, and dental coverage.
• 401(k) retirement plan.
• Short- and long-term disability insurance.
• Life insurance.
• Various discounts and perks.
• Equal opportunity employer.