Government Cloud Security Engineer

SpaceX was founded under the belief that a future where humanity is out exploring the stars is fundamentally more exciting than one where we are not. Today, SpaceX is actively developing the technologies to make this possible, with the ultimate goal of making life multiplanetary and expanding consciousness to the stars. SpaceXSI is building Super Intelligence to help humanity understand the universe. Our teams are building the full Super Intelligence stack: from our Colossus supercomputers, to Grok models, to our suite of applications, including Grok Bot, Grok Build, Grok Imagine, Grok Voice, and X. We're creating a powerful flywheel where more compute trains better models, better models power more useful products, and what we learn from people using those products shapes what we build next. GOVERNMENT CLOUD SECURITY ENGINEER We are seeking a skilled Government Cloud Security Engineer to design, implement, and maintain robust security controls across our Federal environments (including hybrid and multi-cloud scenarios). In this hands-on role, you will build, strengthen, and maintain our security posture, protect critical workloads, and collaborate with engineering, DevOps, and compliance teams to embed security throughout the development lifecycle. You will develop, implement, and leverage a range of security tools to detect threats, respond to incidents, and ensure alignment with industry standards and regulations. Lastly, you will be required to both achieve and maintain compliance with government regulations such as FedRAMP and CMMC. RESPONSIBILITIES: Design, implement, and manage security architecture for federal and DoD deployments across cloud and on-premises environments, aligned to FedRAMP High, DoD IL5/IL6, and NIST SP 800-53 controls Implement and operate security tooling and services such as SIEM and log pipelines, EDR, vulnerability scanners, container runtime security, and policy-as-code enforcement Building secure containerized, Kubernetes-managed environments leveraging Zero Trust principles Secure Linux hosts, Kubernetes clusters, virtualization, and databases, including PKI and TLS, SSH and bastion access, and OS-level auditing Design and enforce identity and access management, including SSO and federation, phishing-resistant MFA, RBAC, just-in-time privileged access, and periodic access reviews Partner with network teams to secure firewalls, VPN and IPsec, DNS, load balancers and reverse proxies, VLAN and subnet segmentation, and routing and switching ACLs Protect data encryption at rest and in transit, including envelope encryption and key management Harden operating systems, network devices, databases, and container platforms against DISA STIGs and CIS Benchmarks, and run credentialed vulnerability and compliance scanning to keep them compliant over time Perform detection, threat hunting, incident response, and root cause analysis, working with the SOC, maintain and exercise the incident response plan, and meet federal incident reporting requirements (e.g., CISA, DoD) Own continuous monitoring end to end, including monthly vulnerability scanning and reporting, deviation requests, and driving POA&M items through remediation and closure Support ATO packages and assessments, including System Security Plan (SSP) and control implementation documentation, 3PAO and DISA assessor evidence requests, and significant change requests Partner with developers and architects to build DevSecOps practices, including secure CI/CD pipelines, secure defaults, and security review of Infrastructure as Code, container images, and Kubernetes deployments before they ship BASIC QUALIFICATIONS: Active U.S. security clearance (e.g., Secret, Top Secret) or eligibility to obtain one 3+ years of hands-on experience in cloud security, cybersecurity, DevSecOps, or infrastructure engineering with a security focus PREFERRED SKILLS AND EXPERIENCE: Microsoft Certified: Azure Security Engineer Associate (AZ-500) or Cybersecurity Architect (SC-100), or other relevant certifications such as CISSP, CCSP, AWS Security Specialty, or GIAC (e.g., GCLD, GCIH) Hands-on experience with Azure security services (Defender, Sentinel, Entra ID, Azure Policy, Key Vault, Purview) and with on-prem Linux, Kubernetes, and network infrastructure (Palo Alto, Cisco, Juniper) Experience with detection and response engineering and SOC operations Knowledge of container and Kubernetes security, software supply chain security (image signing, hardened base images), or AI/ML workload protection Experience supporting FedRAMP High or DoD IL5/IL6 authorizations, including continuous monitoring and assessor interactions Hands-on expertise in building and maintaining secure infrastructure from the ground up in both cloud or on-prem environments Proficiency in scripting/automation (PowerShell, Azure CLI, Bicep/ARM templates, Terraform) Strong understanding of identity federation, zero-trust principles, encryption, network security, and vulnerability management Familiarity with compliance frameworks (NIST, CMMC, STIGs, etc.) and regulatory requirements Excellent problem-solving, analytical, and communication skills Strong verbal and written communication skills and the ability to stay composed under pressure COMPENSATION AND BENEFITS: $100,000 - $198,000 USD Base salary is just one part of our total rewards package at SpaceXSI, which also includes equity, comprehensive medical, vision, and dental coverage, access to a 401(k) retirement plan, short & long-term disability insurance, life insurance, and various other discounts and perks. ITAR REQUIREMENTS: To conform to U.S. Government export regulations, applicant must be a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (aka green card holder), (iii) Refugee under 8 U.S.C. § 1157, or (iv) Asylee under 8 U.S.C. § 1158, or be eligible to obtain the required authorizations from the U.S. Department of State. Learn more about the ITAR here . SpaceXSI is an equal opportunity employer. For details on data processing, view our Recruitment Privacy Notice .