Government Cloud Security Engineer

SpaceXSI is seeking a Government Cloud Security Engineer to build and run security controls for Federal cloud and hybrid environments.

Responsibilities

• Design, implement, and manage security architecture for federal and DoD deployments across cloud and on-prem, aligned to FedRAMP High, DoD IL5/IL6, and NIST SP 800-53
• Implement and operate security tooling and services, including SIEM and log pipelines, EDR, vulnerability scanners, container runtime security, and policy-as-code
• Build secure containerized, Kubernetes-managed environments using Zero Trust principles
• Secure Linux hosts, Kubernetes clusters, virtualization, and databases, including PKI/TLS, SSH and bastion access, and OS-level auditing
• Design and enforce identity and access management: SSO and federation, phishing-resistant MFA, RBAC, just-in-time privileged access, and periodic access reviews
• Partner with network teams to secure firewalls, VPN and IPsec, DNS, load balancers and reverse proxies, VLAN/subnet segmentation, and routing/switching ACLs
• Protect data encryption at rest and in transit, including envelope encryption and key management
• Harden operating systems, network devices, databases, and container platforms against DISA STIGs and CIS Benchmarks, and perform credentialed vulnerability and compliance scanning to maintain alignment over time
• Conduct detection, threat hunting, incident response, and root cause analysis with the SOC; maintain and exercise the incident response plan
• Meet federal incident reporting requirements (examples listed: CISA, DoD)
• Own continuous monitoring end to end, including monthly vulnerability scanning and reporting, managing deviation requests, and driving POA&M items through remediation and closure
• Support ATO packages and assessments, including System Security Plan (SSP) and control implementation documentation, 3PAO and DISA assessor evidence requests, and significant change requests
• Work with developers and architects on DevSecOps: secure CI/CD pipelines, secure defaults, and security review of Infrastructure as Code, container images, and Kubernetes deployments before release

Requirements

• Active U.S. security clearance (e.g., Secret, Top Secret) or eligibility to obtain one
• 3+ years of hands-on experience in cloud security, cybersecurity, DevSecOps, or infrastructure engineering with a security focus

Technologies

• SIEM; EDR; Kubernetes; Zero Trust
• PKI; TLS; SSH; SSO; RBAC; IPsec
• DISA STIGs; CIS Benchmarks
• DevSecOps; CI/CD
• Infrastructure as Code; Policy-as-code
• PowerShell; Azure CLI; Bicep/ARM templates; Terraform
• Defender; Sentinel; Entra ID; Azure Policy; Key Vault; Purview
• Palo Alto; Cisco; Juniper

Preferred skills and experience

• Microsoft Certified Azure Security Engineer Associate (AZ-500) or Cybersecurity Architect (SC-100), or related certifications such as CISSP, CCSP, AWS Security Specialty, or GIAC (e.g., GCLD, GCIH)
• Hands-on experience with Azure security services (Defender, Sentinel, Entra ID, Azure Policy, Key Vault, Purview) and on-prem Linux, Kubernetes, and network infrastructure (Palo Alto, Cisco, Juniper)
• Experience with detection and response engineering and SOC operations
• Knowledge of container and Kubernetes security, software supply chain security (image signing, hardened base images), or AI/ML workload protection
• Experience supporting FedRAMP High or DoD IL5/IL6 authorizations, including continuous monitoring and assessor interactions
• Hands-on expertise building and maintaining secure infrastructure from the ground up in cloud and/or on-prem environments
• Proficiency in scripting/automation: PowerShell, Azure CLI, Bicep/ARM templates, Terraform
• Strong understanding of identity federation, zero-trust principles, encryption, network security, and vulnerability management
• Familiarity with compliance frameworks and regulatory requirements (examples listed: NIST, CMMC, STIGs)
• Excellent problem-solving, analytical, and communication skills; strong verbal and written communication; ability to stay composed under pressure

Compensation and benefits

• Salary: $100,000 - $198,000 USD (per year)
• Equity
• Comprehensive medical, vision, and dental coverage
• 401(k) retirement plan
• Short & long-term disability insurance
• Life insurance
• Various other discounts and perks

ITAR requirements

• Applicant must be a (i) U.S. citizen or national, (ii) U.S. lawful, permanent resident (green card holder), (iii) Refugee under 8 U.S.C. § 1157, or (iv) Asylee under 8 U.S.C. § 1158, or be eligible to obtain the required authorizations from the U.S. Department of State

Location: Palo Alto, CA (onsite)

Minimum experience: 3 years