Security Engineer, Kubernetes
xAI · Palo Alto, CA; Austin, TX; New York, NY; Washington, DC
About this role
**ABOUT THE ROLE** SpaceXSI protects the platform that runs X and SpaceXSI. You’ll proactively identify real risks and exploits in our Kubernetes environments, then turn them into durable fixes and security tooling. If you know pod and platform security, think in attack paths, and want to build defenses that make the platform safer at scale, we want to hear from you. **We Value** - Understanding how Kubernetes can actually be abused—not just how it’s configured - Shipping practical controls and tooling (not just policy documents) - Least privilege and defense-in-depth at fleet scale - Clear findings and fixes that platform teams can act on - Safe, constrained validation that doesn’t put production at risk **RESPONSIBILITIES** - Secure the platform end to end: nodes, clusters, pods, roles, tokens, secrets, service-to-service communication, and the supply chain - Find and remediate overprivileged permissions, dangerous pod/workload settings, and escalation paths across operators, admission, networking, identity, and monitoring - Assess the platform like an adversary (container/pod breakout, privilege escalation, movement across workloads) using safe, constrained validation—then fix what you find - Design and build security tooling and automation, including AI-assisted analysis, to catch risky configuration and overprivilege before or after release - Strengthen identity and secrets handling so workloads receive only the access they need - Improve supply-chain security via secure base images, continuous scanning, and related controls - Review changes affecting RBAC, operators, ServiceAccounts, network policies, and anything running with elevated privileges - Partner with platform and product teams as a security owner—from identification through rollout - Contribute to fleet-wide hardening, policy enforcement, and safer defaults **BASIC QUALIFICATIONS** - 3+ years in platform security, Kubernetes security, or offensive security against production infrastructure - Deep knowledge of pod/workload security: privileged containers, capabilities, host namespaces, host path mounts, service accounts, RBAC, admission control, and network isolation - Working knowledge of identity, secrets, workload identity, service-to-service trust, supply chain, runtime, and cloud access - Ability to think like an attacker, measure blast radius, and turn attack paths into detections, controls, or tools - Comfortable with operators, custom resources, Helm, and GitOps workflows - Able to build/modify security tooling in Go, Python, or Rust when automation is needed - **Bonus:** image scanning, SBOMs, secure base images, policy-as-code (Kyverno/OPA), multi-cluster environments, runtime detection, and security testing of customer-facing applications - Open to working out of: Palo Alto, Austin, DC, or New York **PREFERRED SKILLS AND EXPERIENCE** - Experience developing AI-driven security tools or integrating AI into security workflows - Familiarity with Kubernetes-based environments and securing cloud-native infrastructure - Proven ability to drive technical decisions and influence security practices across teams - Passion for challenging the status quo and building transformative security solutions - Strong collaboration skills in dynamic, cross-functional teams - Sense of humor and adaptability in a fast-paced, mission-driven environment **COMPENSATION AND BENEFITS** - **$100,000 – $258,000 USD** - Base salary is part of a total rewards package including equity, c
Listing freshness
CronJobs last confirmed this listing 1h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.