SpaceX was founded under the belief that a future where humanity is out exploring the stars is fundamentally more exciting than one where we are not. Today SpaceX is actively developing the technologies to make this possible, with the ultimate goal of enabling human life on Mars.
SECURITY ENGINEER (RED TEAM)
SpaceX is looking for a Security Engineer to join our Information Security department to help protect and drive the SpaceX mission.
Information drives our business and we must protect the confidentiality, integrity, and availability of systems and processes across the enterprise. As a highly visible and dynamic organization, we must also value and guard against damage to our reputation and brand. It is paramount that we defend against loss of control or confidence in our systems, to guarantee the highest probability of success.
As a member of the SpaceX Vulnerability Management team, the Security Engineer will act as a trusted partner to application software development teams. This role focuses on identifying, assessing, and remediating vulnerabilities and threats while developing and maintaining internal security tools. The role also includes hands-on work triaging bug reports, conducting Purple and Red Team activities, and continuous threat hunting. Strong communication skills and the ability to turn technical findings into practical, actionable guidance are essential.
RESPONSIBILITIES:
- Development of tools, processes, and guidance that make security easier to adopt without slowing delivery.
- Conduct software code reviews to identify insecure patterns and help teams remediate issues.
- Perform web application security testing using established frameworks and tools.
- Triage and validate Bugcrowd reports, coordinate with researchers, and work directly with internal teams on remediation and disclosure.
- Perform Purple Team exercises to test controls, improve detection, and close identified gaps.
- Contribute to Red Team operations or simulations, including scoping, execution support, and post-exercise analysis.
- Build and operate emerging vulnerability communication processes so teams receive timely, actionable alerts on new threats.
- Conduct continuous threat assessment by folding threat intelligence, emerging vulnerabilities, and attack trends into scanning coverage, notifications, and prioritization.
- Partner with other security sub-teams (detection/response, compliance, application security, infrastructure) to keep efforts consistent and reduce duplication.
- Escalate critical or time-sensitive issues promptly while offering practical mitigation options.
