Infrastructure Security Engineer (Bare Metal & Platform)

SpaceXAI is seeking a hands-on Infrastructure Security Engineer to build and secure infrastructure from the bare-metal layer through private-cloud and into the application stack. The role emphasizes physical hardening, platform security, and embedding security controls into how systems are provisioned, deployed, and monitored.

Location and Compensation

• Location: New York, NY (onsite)
• Salary: USD 100,000 - 258,000 per yearly

Responsibilities

• Design and implement secure bare-metal and private-cloud architectures, including servers, storage, out-of-band management, and BIOS/UEFI/BMC firmware posture
• Harden physical and virtual fleets using OS baselines (Linux/Windows), CIS benchmarks, patch and vulnerability management, and secure boot or measured boot where applicable
• Perform hands-on firmware and hardware security work across BMC/iDRAC/iLO, PXE/Kickstart provisioning, and hardware lifecycle security
• Build and secure network foundations on real hardware, including segmentation, load balancers, DNS, PKI, NAC, and IDS/IPS
• Own hybrid connectivity between on-premises and cloud, including site-to-site VPN, Direct Connect / Interconnect / ExpressRoute, SD-WAN, and zero-trust access
• Manage identities and privileged access across Active Directory / LDAP / Kerberos and cloud IAM, including federation, SAML/OIDC, and PAM
• Support security assessments and audits covering physical, on-premises, and hybrid infrastructure
• Monitor and remediate infrastructure security to align with regulations and best practices (e.g., PCI, NIST CSF, GDPR, HIPAA)
• Define and implement secure container and Kubernetes standards for bare metal and private cloud, including RBAC, network policy, and secrets
• Develop and maintain Infrastructure as Code and configuration management, with an emphasis on Puppet and embedded security controls for both physical and virtual fleets
• Collaborate with development teams to ensure security best practices are integrated into CI/CD pipelines
• Secure and enhance CI/CD pipelines, including integration and maintenance of code and image scanning platforms
• Monitor and respond to security events and incidents spanning bare metal, network devices, hosts, and hybrid cloud
• Maintain SIEM data pipelines that ingest on-premises network, host, and cloud telemetry for reliable alerting
• Build, deploy, and maintain security operations infrastructure using Python, Terraform, and Puppet
• Create dashboards and alerts from security metrics across both physical and platform layers
• Develop and maintain infrastructure security policies, standards, and procedures from metal through platform
• Own security projects end to end, from issue identification through implementation of solutions
• Stay current on emerging threats and mitigations for bare-metal, firmware, network, and hybrid-cloud infrastructure

Requirements

• Education: Bachelor’s degree in Computer Science, Cybersecurity, or a related field
• Experience: 3–5 years of experience in infrastructure security, platform security, or related hands-on roles
• Proven experience securing bare-metal, data-center, or private-cloud environments (not cloud-only resumes)
• Hands-on experience with firmware, BMC/iDRAC/iLO, PXE/Kickstart provisioning, and hardware lifecycle security
• Strong proficiency with Puppet for configuration management and fleet hardening in production
• Strong understanding of network security concepts and protocols, including hands-on work with firewalls, segmentation, and hybrid connectivity
• Experience with hybrid identity (AD/LDAP or similar) integrated or federated with cloud IAM
• Infrastructure as Code experience (e.g., Terraform) applied to physical or VM fleets
• Familiarity with containerization and Kubernetes security implications, including on-premises or bare-metal clusters
• Experience with languages (e.g., Python, Bash and Golang) for automation and tool development
• Familiarity with regulatory compliance requirements (e.g., GDPR, HIPAA, PCI DSS, NIST CSF)
• Experience in banking, money transmission, P2P payments, or similarly regulated financial platforms
• Proactive mindset with strong ownership, critical thinking, and problem-solving skills
• Located in the SF Bay Area, Austin, New York, Palo Alto, or Seattle, or willing to relocate to a US office

Technologies

• Linux, Windows
• BIOS/UEFI/BMC firmware, CIS benchmarks, secure boot, measured boot, BMC, iDRAC, iLO
• PXE, Kickstart
• Active Directory, LDAP, Kerberos, cloud IAM, SAML/OIDC, PAM
• DNS, PKI, NAC, IDS/IPS
• Site-to-site VPN, Direct Connect, Interconnect, ExpressRoute, SD-WAN, zero-trust access
• Kubernetes, RBAC, network policy, secrets
• Infrastructure as Code, Puppet, CI/CD pipelines
• SIEM, Python, Terraform, firewalls
• EKS, GKE, AKS

Benefits

• Equity
• Comprehensive medical, vision, and dental coverage
• Access to a 401(k) retirement plan
• Short & long-term disability insurance
• Life insurance
• Various other discounts and perks
• $100,000 - $258,000 USD base salary

Preferred Skills and Experience

• Deep expertise operating and securing physical server fleets, colo, or private cloud (VMware, OpenStack, Proxmox, Nutanix, or similar)
• Relevant security certifications (e.g., CCSP, CSSK, OSCP, network or cloud security specialty)
• Strong proficiency with Python and Terraform on production fleets
• Deep expertise in Kubernetes and container security on bare metal or private cloud
• Experience with multi-cloud and cloud-to-on-prem security
• Knowledge of CI/CD best practices and tools; hands-on GitHub Actions or equivalent
• Experience with observability and security operations tooling (e.g., Prometheus, Grafana, CloudWatch, Karma; SIEM platforms such as Wazuh)
• Experience building custom security tools or integrations
• Interest in leveraging AI for infrastructure security monitoring and automation
• Contributions to open-source infrastructure or security projects
• Experience securing AI/ML and GPU workloads on bare metal or hybrid infrastructure