Red Team Engineer, Product Security

Job description

Spacecraft represent the most pressing unmet need across the entire aerospace industry. As more launch vehicles come online and the cost to orbit decreases, more companies launching payloads to space continue to emerge. For the first time in history, this influx of payload companies combined with reduced launch costs has resulted in a massive increase in need for commercial spacecraft platforms, known as satellite buses. These buses hold the payloads of our customers and are flown on launch vehicles. Apex manufactures these satellite buses at scale using a combination of software, vertical integration, and hardware that is designed for manufacturing. Our spacecraft enable the future of society: ranging from earth observation to communications and more. We’d love for you to join us on our mission of providing humankind access to the galaxy beyond our planet.  ABOUT THE ROLE As our Red Team Engineer, you will attack our own products the way a capable adversary would: spacecraft, ground stations, cloud command-and-control software, and the pipelines and factory processes that produce them. You will run our internal assessments, lead the outside firms we bring in, build testing tools that keep up the pressure between assessments, and bring an attacker's perspective into design reviews while there is still time to change the design. This is a hands-on engineering role, not an audit, compliance, or security policy role. About the Team Apex builds spacecraft, the flight software that runs them, the ground systems and cloud software used to command them, and the test equipment and emulators used to develop them. In this industry a security failure can cost an entire mission, so we try to find the weaknesses before anyone else does. Product Security is a small team with a big footprint. You would be its second core member, working directly with the Product Security Architect and alongside security engineers embedded in our flight software, ground software, and development infrastructure teams. Responsibilities - Plan and run adversary emulation against our spacecraft, flight software, ground systems, and development pipeline, using SPARTA and MITRE ATT&CK to structure the work. - Look for attack paths that cross system boundaries, such as a ground-system compromise that leads to control of a spacecraft, instead of testing each component in isolation. - Lead our third-party security assessments: set the scope, give the testers the environments and engineering support they need, and bring their results together with our own. - Design and build our fuzzing and automated testing capability, including agent-driven test generation, so testing runs with every release and not just once a year. - Reverse engineer firmware and protocols, analyze embedded hardware interfaces, and review how cryptography is implemented. - Join design reviews and technical trade-offs to show how a proposed design could be attacked before it is built. - Co-chair our product security incident response process, helping triage reported vulnerabilities and coordinate fixes. - Work with engineering teams to fix the root causes of what you find and help other engineers learn to think like attackers. Requirements - US Citizenship - 3-10 years of hands-on offensive security experience in penetration testing, red teaming, exploit development, or vulnerability research. - Track record of building your own tools, harnesses, or automation when nothing off the shelf would do the job. - Experience combining several smaller weaknesses into a realistic attack path. - Solid fundamentals in operating systems, networking, and applied cryptography, and comfort reading and debugging code you have not seen before. - Ability to own a technical project from start to finish with little direction. - Clear communication, whether walking an engineer through a fix or explaining risk to leadership. Preferred - Experience with embedded or cyber-physical systems in space, aerospace, automotive, robotics, industrial/OT, medical devices, or autonomous vehicles. - Experience building fuzzing harnesses for embedded or protocol targets, and working with RTOS, embedded Linux, or hardware interfaces such as JTAG, SWD, SPI, I2C, or CAN. - Experience with AI-assisted security testing. - Familiarity with RF and satellite command links, GNSS spoofing and jamming, or ground station architecture. - Experience scoping or directing the work of outside assessment firms. - Public work such as CVEs, published research, conference talks, or CTF results, or space security training such as the Hack The Box Satellite Exploitation track. - Eligibility for a U.S. security clearance. An active clearance is not required, and the role focuses on unclassified work. Other info - Reports to: Product Security Architect. - Level: Senior individual contributor. We will also consider strong mid-level candidates with deep hands-on experience. #LI-RC1 WHY JOIN APEX? Apex believes in creating a work environment that you look forward to embracing every day. Our employees love working at Apex, and we want you to love it too. We're a fast-growing startup that has raised more than $500M in funding, and we invest heavily in our people from day one. WHAT WE OFFER FOR FULL-TIME EMPLOYEES: - Shared upside: Receive equity in Apex, letting you benefit from the work you create - Best-in-class healthcare: 100% company-paid medical, dental, and vision for you and your dependents, plus $100k life insurance at no cost - Comprehensive PTO package: Starting at 15 days vacation, growing to 20+ days annually, plus 10 paid holidays - Competitive 401(k) plan: Generous matching - 100% match on first 3%, 50% on next 2% - 8 weeks paid parental leave: Plus childcare reimbursement up to $350/day for work-related travel - Daily catered lunch and unlimited snacks: To keep you fueled throughout the day - Vibrant community Monthly office socials, pickleball tournaments, run club, and gatherings for you and your family - Your dream desk setup All the tools you need to be your most productive self - World-class Playa Vista office: With the benefit of in-person collaboration with amazing coworkers and flexibility to integrate work and life - Real impact opportunity: Work alongside experts from aerospace, new space, and other cutting-edge industries to make a lasting difference ADDITIONAL INFORMATION: Compensation ranges are set by role, level, location, and alignment with market data. A candidate's specific level and base pay are determined case by case and may vary with job-related skills, education, experience, technical capabilities, and internal equity. Beyond base salary, full-time hires are also eligible for long-term incentives in the form of stock options, along with medical, dental, and vision coverage and a 401(k) retirement plan. ITAR REQUIREMENTS Apex's work is governed by U.S. export control laws, including the International Traffic in Arms Regulations (ITAR) and the Export Administration Regulations (EAR). To be eligible for this role, applicants must either (1) qualify as a U.S. Person, meaning a U.S. citizen or national, a lawful permanent resident (green card holder), a refugee admitted under 8 U.S.C. § 1157, or an individual granted asylum under 8 U.S.C. § 1158, or (2) be able to obtain the required export authorizations from the U.S. Department of State, the U.S. Department of Commerce, or another applicable U.S. government agency. You can learn more about ITAR here https://www.pmddtc.state.gov/?id=ddtc_kb_article_page&sys_id=24d528fddbfc930044f9ff621f961987. EQUAL OPPORTUNITY EMPLOYER Apex Technology, Inc. is an Equal Opportunity Employer. We celebrate diversity and are committed to creating an inclusive environment for all employees. Candidates and employees are always evaluated based on merit, qualifications, and performance. We will never discriminate on the basis of race, color, gender, national origin, ethnicity, veteran status, disability status, age, sexual orientation, gender identity, marital status, mental or physical disability, or any other legally protected status.