SpaceX Sr. Security Engineer (Vulnerability Management) at SpaceX responsible for identifying, assessing, and remediating vulnerabilities and threats. Develop and maintain internal security tools and conduct Purple and Red Team activities.
Responsibilities
Development of tools, processes, and guidance that make security easier to adopt without slowing delivery.
Conduct software code reviews to identify insecure patterns and help teams remediate issues.
Perform web application security testing using established frameworks and tools.
Triage and validate Bugcrowd reports, coordinate with researchers, and work directly with internal teams on remediation and disclosure.
Perform Purple Team exercises to test controls, improve detection, and close identified gaps.
Contribute to Red Team operations or simulations, including scoping, execution support, and post-exercise analysis.
Build and operate emerging vulnerability communication processes so teams receive timely, actionable alerts on new threats.
Conduct continuous threat assessment by folding threat intelligence, emerging vulnerabilities, and attack trends into scanning coverage, notifications, and prioritization.
Partner with other security sub-teams (detection/response, compliance, application security, infrastructure) to keep efforts consistent and reduce duplication.
Escalate critical or time-sensitive issues promptly while offering practical mitigation options.
Document findings, produce metrics, and provide regular risk summaries to leadership.
Bachelor's degree in computer science or another STEM discipline; OR 2+ years of professional experience operating production infrastructure and high school diploma or equivalency certificate in lieu of a degree.
5+ years of experience operating on-premises Kubernetes in a production environment.
5+ years of experience with Linux system administration and with Python, Go, or another language used to automate infrastructure.
Preferred
Experience identifying, assessing, and remediating vulnerabilities (applications, infrastructure, or cloud).
Experience working directly with engineering teams to close findings.
Scripting/automation experience (Python, Bash, PowerShell, or similar) and the ability to develop internal tools.
Strong understanding of networking fundamentals (TCP/IP, DNS, HTTP/S, firewalls) and how they relate to vulnerability exposure.
Reverse engineering or vulnerability development experience.
Experience triaging or working reports from bug bounty platforms (Bugcrowd, HackerOne, or similar).
Hands-on participation in Purple Team or Red Team exercises.
