Security Engineer, Kubernetes

# Security Engineer, KubernetesxAI  
· x.ai Category:
Cloud Security

Location:

Palo Alto, CA;
Austin, TX;
New York, NY;
Washington, DCSalary:
$100,000 – $258,000## Quality of life

What the posting states. Hover or tap a perk to see the line it came from.
* Equity* Flexible PTOSpaceX was founded under the belief that a future where humanity is out exploring the stars is fundamentally more exciting than one where we are not. Today, SpaceX is actively developing the technologies to make this possible, with the ultimate goal of making life multiplanetary and expanding consciousness to the stars.

SpaceXSI is building Super Intelligence to help humanity understand the universe. Our teams are building the full Super Intelligence stack: from our Colossus supercomputers, to Grok models, to our suite of applications, including Grok Bot, Grok Build, Grok Imagine, Grok Voice, and X. We're creating a powerful flywheel where more compute trains better models, better models power more useful products, and what we learn from people using those products shapes what we build next.

ABOUT THE ROLE:

We protect the platform that runs X and SpaceXSI. We don’t just report issues, we actively look for real risks and exploits in our Kubernetes environments and turn them into durable fixes and tooling. You will secure the platform behind X and SpaceXSI’s infrastructure, products, and workloads. If you know pod and platform security, think in attack paths, and want to build the defenses that make the platform safer at scale, we want to hear from you.

We Value Understanding how Kubernetes can actually be abused, not only how it is configured

Shipping practical controls and tooling over writing policy documents

Least privilege and defense-in-depth at fleet scale

Clear findings and fixes that platform teams can act onSafe, constrained validation that does not put production at risk RESPONSIBILITIES:

Secure the platform end to end: nodes, clusters, pods, roles, tokens, secrets, service-to-service communication, and the supply chain

Find and remediate over privileged permissions, dangerous pod and workload settings, and escalation paths in operators, admission, networking, identity, and monitoring

Assess our own platform the way an adversary would, including container and pod breakout, privilege escalation, and movement across workloads, using safe and constrained validation, then fix what you find Design and build security tooling and automation, including AI-assisted analysis, that catches risky configuration and over privilege before or after it ships

Strengthen identity and secrets handling so workloads receive only the access they need Improve supply-chain security through secure base images, continuous scanning, and related controls

Review changes that affect RBAC, operators, Service Accounts, network policies, and anything running with elevated privileges

Partner with platform and product teams as a security owner, taking problems from identification through rollout

Contribute to fleet-wide hardening, policy enforcement, and safer defaults

BASIC QUALIFICATIONS:

3+ years in platform security, Kubernetes security, or offensive security against production infrastructure

Deep knowledge of pod and workload security: privileged containers, capabilities, host name spaces, host path mounts, service accounts, RBAC, admission control, and network isolation

Working knowledge of identity, secrets, workload identity, service-to-service trust, supply chain, runtime, and cloud access

Able to think like an attacker, measure blast radius, and turn the path into a detection, control, or tool Comfortable with operators, custom resources, Helm, and Git Ops workflows

Able to build or modify security tooling in Go, Python, or Rust when a control needs…