Infrastructure Security Engineer (Bare Metal & Platform)

Job Application for Infrastructure Security Engineer (Bare Metal & Platform) at SpaceXAI

Back to jobs New Infrastructure Security Engineer (Bare Metal & Platform) Palo Alto, CA; Austin, TX; New York, NY; Seattle, WA

SpaceXAI’s mission is to create AI systems that can accurately understand the universe and aid humanity in its pursuit of knowledge. Our team is small, highly motivated, and focused on engineering excellence. This organization is for individuals who appreciate challenging themselves and thrive on curiosity. We operate with a flat organizational structure. All employees are expected to be hands-on and to contribute directly to the company’s mission. Leadership is given to those who show initiative and consistently deliver excellence. Work ethic and strong prioritization skills are important. All employees are expected to have strong communication skills. They should be able to concisely and accurately share knowledge with their teammates.

ABOUT THE ROLE:

We are seeking a hands-on Infrastructure Security Engineer to build and secure SpaceXAI’s infrastructure from the bare-metal layer up through the platform and application stack. In this role, you will design, implement, and harden physical and private-cloud foundations—servers, networks, identity, and orchestration—and carry that security posture into containers, automation, and hybrid connectivity with public cloud.

This role focuses on securing critical infrastructure spanning data centers, colo, and hybrid environments, with work that may span platforms such as SpaceXAI, X Social, X Money, and related systems. You’ll operate with an automation-first mindset: building secure foundations at the metal and OS layer, hardening platforms at scale, and partnering closely with engineering so security is embedded in how we build and run systems—not bolted on after the fact.

RESPONSIBILITIES:

Bare metal, data center & network security

Design and implement secure bare-metal and private-cloud architectures (servers, storage, out-of-band management, BIOS/UEFI/BMC firmware posture)

Harden physical and virtual fleets: OS baselines (Linux/Windows), CIS benchmarks, patch and vulnerability management, and secure boot / measured boot where applicable

Hands-on firmware, BMC/iDRAC/iLO, PXE/Kickstart provisioning, and hardware lifecycle security

Build and secure network foundations: segmentation, load balancers, DNS, PKI, NAC, and IDS/IPS on real hardware

Own hybrid connectivity between on-premises and cloud (site-to-site VPN, Direct Connect / Interconnect / ExpressRoute, SD-WAN, zero-trust access)

Manage identities and privileged access across Active Directory / LDAP / Kerberos and cloud IAM (federation, SAML/OIDC, PAM)

Assist with security assessments and audits of physical, on-premises, and hybrid infrastructure

Monitor and remediate infrastructure to comply with regulations and best practices (e.g., PCI, NIST CSF, GDPR, HIPAA)

Platform, containers & developer enablement

Design and implement secure container and Kubernetes standards on bare metal and private cloud (not only managed EKS/GKE/AKS), including RBAC, network policy, and secrets

Develop and maintain Infrastructure as Code and configuration management—especially Puppet—with embedded security controls for physical and virtual fleets

Collaborate with development teams so security best practices are integrated into CI/CD pipelines

Secure and enhance CI/CD pipelines; integrate and maintain code and image scanning platforms

Detection, operations & tooling

Monitor and respond to security events and incidents spanning bare metal, network devices, hosts, and hybrid cloud

Maintain SIEM data pipelines that ingest on-premises network, host, and cloud telemetry for reliable alerting

Build, deploy, and maintain security operations infrastructure using Python, Terraform, and Puppet

Develop dashboards and alerts from security metrics across physical and platform layers

Develop and maintain infrastructure security policies, standards, and procedures from metal through platform

Own security projects end to end: identify issues and implement solutions

Stay current with emerging threats and mitigations for bare-metal, firmware, network, and hybrid-cloud infrastructure

BASIC QUALIFICATIONS:

Bachelor's degree in Computer Science, Cybersecurity, or a related field

3–5 years of experience in infrastructure security, platform security, or related hands-on roles

Proven experience securing bare-metal, data-center, or private-cloud environments (not cloud-only resumes)

Hands-on experience with firmware, BMC/iDRAC/iLO, PXE/Kickstart provisioning, and hardware lifecycle security

Strong proficiency with Puppet for configuration management and fleet hardening in production

Strong understanding of network security concepts and protocols, including hands-on work with firewalls, segmentation, and hybrid connectivity

Experience with hybrid identity (AD/LDAP or similar) integrated or federated with cloud IAM

Experience with Infrastructure as Code (e.g., Terraform) applied to physical or VM fleets

Familiarity with containerization and Kubernetes security implications, including on-premises or bare-metal clusters

Experience with languages (e.g., Python, Bash and Golang) for automation and tool development

Familiarity with regulatory compliance requirements (e.g., GDPR, HIPAA, PCI DSS, NIST CSF)

Experience in banking, money transmission, P2P payments, or similarly regulated financial platforms

Proactive mindset with strong ownership, critical thinking, and problem-solving skills

Located in the SF Bay Area, Austin, New York, Palo Alto, or Seattle, or willing to relocate to a US office

PREFERRED SKILLS AND EXPERIENCE:

Deep expertise operating and securing physical server fleets, colo, or private cloud (VMware, OpenStack, Proxmox, Nutanix, or similar)

Relevant security certifications (e.g., CCSP, CSSK, OSCP, network or cloud security specialty)

Strong proficiency with Python and Terraform on production fleets

Deep expertise in Kubernetes and container security on bare metal or private cloud

Experience with multi-cloud and cloud-to-on-prem security

Knowledge of CI/CD best practices and tools; hands-on GitHub Actions or equivalent

Experience with observability and security operations tooling (e.g., Prometheus, Grafana, CloudWatch, Karma; SIEM platforms such as Wazuh)

Experience building custom security tools or integrations

Interest in leveraging AI for...