Security Engineer

Security Engineer (Red Team) role within SpaceX Information Security/Vulnerability Management, focused on finding, validating, and driving remediation of vulnerabilities and threats while building security tooling.

Responsibilities

• Develop tools, processes, and guidance that help teams adopt security practices without slowing delivery
• Conduct software code reviews to identify insecure patterns and support remediation
• Perform web application security testing using established frameworks and tools
• Triage and validate Bugcrowd reports; coordinate with researchers; work with internal teams on remediation and disclosure
• Run Purple Team exercises to test controls, improve detection, and close gaps
• Contribute to Red Team operations or simulations, including scoping, execution support, and post-exercise analysis
• Build and operate vulnerability communication processes to deliver timely, actionable alerts on new threats
• Conduct continuous threat assessment by incorporating threat intelligence, emerging vulnerabilities, and attack trends into scanning coverage, notifications, and prioritization
• Partner with other security sub-teams (detection/response, compliance, application security, infrastructure) to align efforts and reduce duplication
• Escalate critical or time-sensitive issues promptly, with practical mitigation options
• Document findings, produce metrics, and provide regular risk summaries to leadership

Requirements

• Bachelor’s degree in computer science or another STEM discipline OR 2+ years of professional experience in security software development in lieu of a degree
• Experience with Python; experience with GO, C#, C/C++, or Rust
• Experience designing and implementing security solutions for operating systems, distributed systems, or other enterprise/large-scale infrastructure

Preferred Skills and Experience

• Experience identifying, assessing, and remediating vulnerabilities (applications, infrastructure, or cloud)
• Experience working directly with engineering teams to close findings
• Scripting and automation experience (Python, Bash, PowerShell, or similar) and ability to develop internal tools
• Strong networking fundamentals understanding (TCP/IP, DNS, HTTP/S, firewalls) and how they relate to vulnerability exposure
• Reverse engineering or vulnerability development experience
• Experience triaging or working reports from bug bounty platforms (Bugcrowd, HackerOne, or similar)
• Hands-on participation in Purple Team or Red Team exercises
• OT Security experience
• Experience with continuous threat assessment, threat intelligence, or risk-based vulnerability prioritization
• Experience developing internal security tools, dashboards, or automation pipelines (production-quality code, integrations, etc.)
• Experience with web application testing frameworks and tools
• Experience performing software code reviews for security issues
• Experience improving developer experience around security tooling and processes
• Knowledge of network segmentation principles and implementation
• Experience with asset discovery or inventory processes
• Experience building or operating emerging vulnerability notification/alerting workflows
• Familiarity with AI/LLMs and MCPs
• Familiarity with cloud environments (AWS, Azure, GCP) and their native security/vulnerability features
• Experience with configuration management, patching, or infrastructure-as-code
• Knowledge of threat modeling, risk scoring (e.g., CVSS), and prioritization frameworks
• Familiarity with enterprise security controls and best practices for Windows, Linux, and macOS
• Strong communication skills to translate technical findings into business impact and concrete remediation steps
• Relevant certifications (e.g., OSCP, GSEC, or equivalent) or demonstrated equivalent experience
• Demonstrable problem-solving skills and ability to quickly determine root causes

Technologies

• Python
• GO
• C#
• C/C++
• Rust
• Bugcrowd

Additional Requirements

• Must be willing to work extended hours and/or weekends as needed
• Onsite role in Texas; hybrid or remote work will not be considered

ITAR Requirements

• To conform to U.S. Government export regulations, applicant must be a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (green card holder), (iii) Refugee under 8 U.S.C. § 1157, or (iv) Asylee under 8 U.S.C. § 1158, or be eligible to obtain the required authorizations from the U.S. Department of State