Security Engineer (Vulnerability Management)

SpaceX is building security programs that help engineering teams move fast while improving resilience. As a Security Engineer for Vulnerability Management, you will identify, assess, remediate, and communicate vulnerabilities and threats, while also building and maintaining internal security tools and processes that make security easier to adopt without slowing delivery.

Location: Texas (onsite)

Experience: 2+ years

What you’ll do

• Develop tools, processes, and guidance to improve vulnerability workflows and support delivery.
• Perform software code reviews to uncover insecure patterns and help teams remediate issues.
• Conduct web application security testing using established frameworks and tools.
• Triage and validate Bugcrowd reports, coordinate with researchers, and work with internal teams on remediation and disclosure.
• Run Purple Team exercises to test controls, improve detection, and close gaps.
• Contribute to Red Team operations or simulations, including scoping, execution support, and post-exercise analysis.
• Build and operate emerging vulnerability communication processes to deliver timely, actionable alerts on new threats.
• Support continuous threat assessment by incorporating threat intelligence, emerging vulnerabilities, and attack trends into scanning coverage, notifications, and prioritization.
• Partner with other security sub-teams (detection/response, compliance, application security, infrastructure) to keep efforts consistent and reduce duplication.
• Escalate critical or time-sensitive issues promptly and provide practical mitigation options.
• Document findings, produce metrics, and deliver regular risk summaries to leadership.

Requirements

• Bachelor’s degree in computer science or another STEM discipline, or 2+ years of professional experience in security software development in lieu of a degree.
• Experience with Python, GO, C#, C/C++, or Rust.
• Experience designing and implementing security solutions for operating systems, distributed systems, or other enterprise or large-scale infrastructure.

Technologies you’ll work with

• Python, GO, C#, C/C++, Rust
• Bugcrowd
• HTTP/S, DNS, TCP/IP

Preferred skills

• Experience identifying, assessing, and remediating vulnerabilities across applications, infrastructure, or cloud.
• Experience working directly with engineering teams to close findings.
• Scripting and automation experience (Python, Bash, PowerShell, or similar), with the ability to develop internal tools.
• Strong networking fundamentals (TCP/IP, DNS, HTTP/S, firewalls) and how they relate to exposure.
• Reverse engineering or vulnerability development experience.
• Experience triaging or working reports from bug bounty platforms (Bugcrowd, HackerOne, or similar).
• Hands-on participation in Purple Team or Red Team exercises.
• OT Security experience.
• Experience with continuous threat assessment, threat intelligence, or risk-based vulnerability prioritization.
• Experience developing internal security tools, dashboards, or automation pipelines.
• Experience with web application testing frameworks and tools.
• Experience performing software code reviews for security issues.
• Experience improving developer experience around security tooling and processes.
• Knowledge of network segmentation principles and implementation.
• Experience with asset discovery or inventory processes.
• Experience building or operating emerging vulnerability notification or alerting workflows.
• Familiarity with AI/LLMs and MCPs.
• Familiarity with cloud environments (AWS, Azure, GCP) and native security or vulnerability features.
• Experience with configuration management, patching, or infrastructure-as-code.
• Knowledge of threat modeling, risk scoring (for example, CVSS), and prioritization frameworks.
• Familiarity with enterprise security controls and best practices for Windows, Linux, and macOS.
• Strong communication skills, translating technical findings into business impact and remediation steps.
• Relevant certifications (for example, OSCP, GSEC, or equivalent) or demonstrated equivalent experience.
• Demonstrable problem-solving skills and the ability to determine root causes quickly.

Additional requirements

• Must be willing to work extended hours and/or weekends as needed.
• This role requires onsite work. Hybrid or remote work will not be considered.

ITAR requirements

To conform to U.S. Government export regulations, applicant must be a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (aka green card holder), (iii) Refugee under 8 U.S.C. § 1157, or (iv) Asylee under 8 U.S.C. § 1158, or be eligible to obtain the required authorizations from the U.S. Department of State.