Security Engineer (Vulnerability Management)

SpaceX develops technologies intended to enable human life on Mars and supports exploration beyond Earth. The Security Engineer will help protect enterprise systems by identifying, assessing, and remediating vulnerabilities, developing internal security tools, conducting security testing, and partnering with software development and security teams.

Responsibilities

Development of tools, processes, and guidance that make security easier to adopt without slowing delivery

Conduct software code reviews to identify insecure patterns and help teams remediate issues

Perform web application security testing using established frameworks and tools

Triage and validate Bugcrowd reports, coordinate with researchers, and work directly with internal teams on remediation and disclosure

Perform Purple Team exercises to test controls, improve detection, and close identified gaps

Contribute to Red Team operations or simulations, including scoping, execution support, and post-exercise analysis

Build and operate emerging vulnerability communication processes so teams receive timely, actionable alerts on new threats

Conduct continuous threat assessment by folding threat intelligence, emerging vulnerabilities, and attack trends into scanning coverage, notifications, and prioritization

Partner with other security sub-teams (detection/response, compliance, application security, infrastructure) to keep efforts consistent and reduce duplication

Escalate critical or time-sensitive issues promptly while offering practical mitigation options

Document findings, produce metrics, and provide regular risk summaries to leadership

Preferred

* Experience identifying, assessing, and remediating vulnerabilities (applications, infrastructure, or cloud)

* Experience working directly with engineering teams to close findings

* Scripting/automation experience (Python, Bash, PowerShell, or similar) and the ability to develop internal tools

* Strong understanding of networking fundamentals (TCP/IP, DNS, HTTP/S, firewalls) and how they relate to vulnerability exposure

* Reverse engineering or vulnerability development experience

* Experience triaging or working reports from bug bounty platforms (Bugcrowd, HackerOne, or similar)

* Hands-on participation in Purple Team or Red Team exercises

* OT Security Experience

* Experience with continuous threat assessment, threat intelligence, or risk-based vulnerability prioritization

* Experience developing internal security tools, dashboards, or automation pipelines (production-quality code, integrations, etc.)

* Experience with web application testing frameworks and tools

* Experience performing software code reviews for security issues

* Experience improving developer experience around security tooling and processes

* Knowledge of network segmentation principles and implementation

* Experience with asset discovery or inventory processes

* Experience building or operating emerging vulnerability notification/alerting workflows

* Familiarity with AI/LLMs and MCPs

* Familiarity with cloud environments (AWS, Azure, GCP) and their native security/vulnerability features

* Experience with configuration management, patching, or infrastructure-as-code

* Knowledge of threat modeling, risk scoring (e.g., CVSS), and prioritization frameworks

* Familiarity with enterprise security controls and best practices for Windows, Linux, and macOS

* Strong communication skills with the ability to translate technical findings into business impact and concrete remediation steps

* Relevant certifications (e.g., OSCP, GSEC, or equivalent) or demonstrated equivalent experience

* Demonstrable problem-solving skills and ability to quickly determine root causes of issues

Vulnerability Assessment

Vulnerability Remediation

Application Security

Infrastructure Security

Cloud Security

Security Findings Closure

Scripting

Bash

PowerShell

Security Tool Development

Security Automation

Networking Fundamentals

TCP/IP

DNS

HTTP/S

Firewall Security

Vulnerability Exposure Analysis

Reverse Engineering

Vulnerability Development

Bug Bounty Triage

Purple Team Exercises

Red Team Exercises

OT Security

Threat Assessment

Threat Intelligence

Risk-Based Prioritization

Security Dashboards

Automation Pipelines

Security Integrations

Web Application Testing

Security Code Reviews

Developer Security Experience

Network Segmentation

Asset Discovery

Asset Inventory

Vulnerability Alerting Workflows

AI/LLM Familiarity

MCP Familiarity

AWS Security

Azure Security

GCP Security

Cloud Vulnerability Features

Configuration Management

Patch Management

Infrastructure as Code

Threat Modeling

CVSS Risk Scoring

Risk Prioritization Frameworks

Enterprise Security Controls

Windows Security

Linux Security

macOS Security

Security Certifications

OSCP

GSEC

Communication

Technical-to-Business Translation

Problem-Solving

Root Cause Analysis

Engineering Collaboration

Company

Designs, manufactures, and launches advanced rockets and spacecraft

Hawthorne, California, USA

https://www.spacex.com/

Founded in 2002

1001-5000 employees

Qualifications

* Bachelor's degree in computer science or another STEM discipline; OR 2+ years of professional experience in security software development in lieu of a degree

* Experience with the Python programming language, GO, C#, C/C++, or Rust

* Experience designing and implementing security solutions for operating systems, distributed systems, or other enterprise/large-scale infrastructure

* Must be willing to work extended hours and/or weekends as needed

* This role requires you to be onsite. Hybrid or remote work will not be considered

* To conform to U.S. Government export regulations, applicant must be a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (aka green card holder), (iii) Refugee under 8 U.S.C. § 1157, or (iv) Asylee under 8 U.S.C. § 1158, or be eligible to obtain the required authorizations from the U.S. Department of State

* Experience identifying, assessing, and remediating vulnerabilities (applications, infrastructure, or cloud)

* Experience working directly with engineering teams to close findings

* Scripting/automation experience (Python, Bash, PowerShell, or similar) and the ability to develop internal tools

* Strong understanding of networking fundamentals (TCP/IP, DNS, HTTP/S, firewalls) and how they relate to vulnerability exposure

* Reverse engineering or vulnerability development experience

* Experience triaging or working reports from bug bounty platforms (Bugcrowd, HackerOne, or similar)

* Hands-on participation in Purple Team or Red Team exercises

* OT Security Experience

* Experience with continuous threat assessment, threat intelligence, or risk-based vulnerability prioritization

* Experience developing internal security tools, dashboards, or automation pipelines (production-quality code, integrations, etc.)

* Experience with web application testing frameworks and tools

* Experience performing software code reviews for security issues

* Experience improving developer experience around security tooling and processes

* Knowledge of network segmentation principles and implementation

* Experience with asset discovery or inventory processes

* Experience building or operating emerging vulnerability notification/alerting workflows

* Familiarity with AI/LLMs and MCPs

* Familiarity with cloud environments (AWS, Azure, GCP) and their native security/vulnerability features

* Experience with configuration management, patching, or infrastructure-as-code

* Knowledge of threat modeling, risk scoring (e.g., CVSS), and prioritization frameworks

* Familiarity with enterprise security controls and best practices for Windows, Linux, and macOS

* Strong communication skills with the ability to translate technical findings into business impact and concrete remediation steps

* Relevant certifications (e.g., OSCP, GSEC, or equivalent) or demonstrated equivalent experience

* Demonstrable problem-solving skills and ability to quickly determine root causes of issues

* Bachelor's degree in computer science or another STEM discipline; OR 2+ years of professional experience in security software development in lieu of a degree.

Required skills

Represents the skills you have, click on the tags, Vulnerability Assessment and Remediation, Security Solution Design, Web Application Security Testing, Security Code Review, Security Scripting and Automation, Threat Intelligence and Risk-Based Vulnerability Prioritization, Purple Team and Red Team Operations, Bug Bounty Report Triage

Preferred skills

* OT Security Experience, * Experience with asset discovery or inventory processes, * Familiarity with AI/LLMs and MCPs, Glassdoor, 3.8, Hawthorne, California, USA, https://www.spacex.com, Public Company, Total Funding, $37.46B, Key Investors, Intesa Sanpaolo, Andreessen Horowitz, Mirae Asset Venture Investment, 2026-06-23, Post Ipo Debt· $25B, 2026-06-12, IPO, 2026-04-30, Secondary Market, Leadership Team, Elon Musk, Chief Executive Officer, Bret Johnsen, CFO, Recent News, Quartz, 2026-10-17, The Motley Fool, Iraqi News

Experience

2+ years