Security Engineer (Red Team)

SpaceX develops technologies intended to enable human life on Mars and advance humanity’s exploration of space. The Security Engineer will join the Vulnerability Management team to identify, assess, and remediate vulnerabilities and threats, develop internal security tools, and support application development teams. The role includes code reviews, web application security testing, bug report triage, Purple and Red Team activities, threat hunting, and communicating actionable security guidance.

Responsibilities

Development of tools, processes, and guidance that make security easier to adopt without slowing delivery

Conduct software code reviews to identify insecure patterns and help teams remediate issues

Perform web application security testing using established frameworks and tools

Triage and validate Bugcrowd reports, coordinate with researchers, and work directly with internal teams on remediation and disclosure

Perform Purple Team exercises to test controls, improve detection, and close identified gaps

Contribute to Red Team operations or simulations, including scoping, execution support, and post-exercise analysis

Build and operate emerging vulnerability communication processes so teams receive timely, actionable alerts on new threats

Conduct continuous threat assessment by folding threat intelligence, emerging vulnerabilities, and attack trends into scanning coverage, notifications, and prioritization

Partner with other security sub-teams (detection/response, compliance, application security, infrastructure) to keep efforts consistent and reduce duplication

Escalate critical or time-sensitive issues promptly while offering practical mitigation options

Document findings, produce metrics, and provide regular risk summaries to leadership

Preferred

Experience identifying, assessing, and remediating vulnerabilities (applications, infrastructure, or cloud)

Experience working directly with engineering teams to close findings

Scripting/automation experience (Python, Bash, PowerShell, or similar) and the ability to develop internal tools

Strong understanding of networking fundamentals (TCP/IP, DNS, HTTP/S, firewalls) and how they relate to vulnerability exposure

Reverse engineering or vulnerability development experience

Experience triaging or working reports from bug bounty platforms (Bugcrowd, HackerOne, or similar)

Hands-on participation in Purple Team or Red Team exercises

OT Security Experience

Experience with continuous threat assessment, threat intelligence, or risk-based vulnerability prioritization

Experience developing internal security tools, dashboards, or automation pipelines (production-quality code, integrations, etc.)

Experience with web application testing frameworks and tools

Experience performing software code reviews for security issues

Experience improving developer experience around security tooling and processes

Knowledge of network segmentation principles and implementation

Experience with asset discovery or inventory processes

Experience building or operating emerging vulnerability notification/alerting workflows

Familiarity with AI/LLMs and MCPs

Familiarity with cloud environments (AWS, Azure, GCP) and their native security/vulnerability features

Experience with configuration management, patching, or infrastructure-as-code

Knowledge of threat modeling, risk scoring (e.g., CVSS), and prioritization frameworks

Familiarity with enterprise security controls and best practices for Windows, Linux, and macOS

Strong communication skills with the ability to translate technical findings into business impact and concrete remediation steps

Relevant certifications (e.g., OSCP, GSEC, or equivalent) or demonstrated equivalent experience

Demonstrable problem-solving skills and ability to quickly determine root causes of issues

Vulnerability Assessment

Vulnerability Remediation

Application Security

Infrastructure Security

Cloud Security

Engineering Remediation

Bash

PowerShell

Scripting

Security Automation

Internal Tool Development

Networking Fundamentals

TCP/IP

DNS

HTTP/S

Firewalls

Vulnerability Exposure Analysis

Reverse Engineering

Vulnerability Development

Bug Bounty Triage

Bugcrowd

HackerOne

Purple Team Exercises

Red Team Exercises

OT Security

Threat Assessment

Threat Intelligence

Risk-Based Prioritization

Security Dashboards

Automation Pipelines

Security Integrations

Web Application Testing

Security Code Review

Developer Security Experience

Network Segmentation

Asset Discovery

Asset Inventory

Vulnerability Alerting Workflows

AI/LLMs

MCPs

AWS

Azure

GCP

Cloud Vulnerability Features

Configuration Management

Patching

Infrastructure as Code

Threat Modeling

CVSS Risk Scoring

Prioritization Frameworks

Enterprise Security Controls

Windows Security

Linux Security

macOS Security

Remediation Guidance

OSCP

GSEC

Communication

Problem-Solving

Root-Cause Analysis

Cross-Functional Collaboration

Benefits

This role requires you to be onsite. Hybrid or remote work will not be considered.

Company

Designs, manufactures, and launches advanced rockets and spacecraft

Hawthorne, California, USA

https://www.spacex.com/

Founded in 2002

1001-5000 employees

Qualifications

Bachelor's degree in computer science or another STEM discipline; OR 2+ years of professional experience in security software development in lieu of a degree

Experience with the Python programming language, GO, C#, C/C++, or Rust

Experience designing and implementing security solutions for operating systems, distributed systems, or other enterprise/large-scale infrastructure

Must be willing to work extended hours and/or weekends as needed

This role requires you to be onsite. Hybrid or remote work will not be considered

To conform to U.S. Government export regulations, applicant must be a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (aka green card holder), (iii) Refugee under 8 U.S.C. § 1157, or (iv) Asylee under 8 U.S.C. § 1158, or be eligible to obtain the required authorizations from the U.S. Department of State

Experience identifying, assessing, and remediating vulnerabilities (applications, infrastructure, or cloud)

Experience working directly with engineering teams to close findings

Scripting/automation experience (Python, Bash, PowerShell, or similar) and the ability to develop internal tools

Strong understanding of networking fundamentals (TCP/IP, DNS, HTTP/S, firewalls) and how they relate to vulnerability exposure

Reverse engineering or vulnerability development experience

Experience triaging or working reports from bug bounty platforms (Bugcrowd, HackerOne, or similar)

Hands-on participation in Purple Team or Red Team exercises

OT Security Experience

Experience with continuous threat assessment, threat intelligence, or risk-based vulnerability prioritization

Experience developing internal security tools, dashboards, or automation pipelines (production-quality code, integrations, etc.)

Experience with web application testing frameworks and tools

Experience performing software code reviews for security issues

Experience improving developer experience around security tooling and processes

Knowledge of network segmentation principles and implementation

Experience with asset discovery or inventory processes

Experience building or operating emerging vulnerability notification/alerting workflows

Familiarity with AI/LLMs and MCPs

Familiarity with cloud environments (AWS, Azure, GCP) and their native security/vulnerability features

Experience with configuration management, patching, or infrastructure-as-code

Knowledge of threat modeling, risk scoring (e.g., CVSS), and prioritization frameworks

Familiarity with enterprise security controls and best practices for Windows, Linux, and macOS

Strong communication skills with the ability to translate technical findings into business impact and concrete remediation steps

Relevant certifications (e.g., OSCP, GSEC, or equivalent) or demonstrated equivalent experience

Demonstrable problem-solving skills and ability to quickly determine root causes of issues

Bachelor's degree in computer science or another STEM discipline; OR 2+ years of professional experience in security software development in lieu of a degree.

Required skills

Python, Go, C#, C/C++, Rust, Security Solution Design, Vulnerability Assessment and Remediation, Web Application Security Testing, Red Team Operations, Purple Team Exercises, Threat Intelligence

Preferred skills

Reverse engineering or vulnerability development experience, Hands-on participation in Purple Team or Red Team exercises, OT Security Experience, Experience with web application testing frameworks and tools, Experience with asset discovery or inventory processes, Familiarity with AI/LLMs and MCPs

Experience

2+ years