Red Team Engineer, Product Security

The posting, as Apex Technology, Inc. wrote it

Spacecraft represent the most pressing unmet need across the entire aerospace industry. As more launch vehicles come online and the cost to orbit decreases, more companies launching payloads to space continue to emerge.

For the first time in history, this influx of payload companies combined with reduced launch costs has resulted in a massive increase in need for commercial spacecraft platforms, known as satellite buses. These buses hold the payloads of our customers and are flown on launch vehicles.

Apex manufactures these satellite buses at scale using a combination of software, vertical integration, and hardware that is designed for manufacturing. Our spacecraft enable the future of society: ranging from earth observation to communications and more.

We’d love for you to join us on our mission of providing humankind access to the galaxy beyond our planet.

ABOUT THE ROLE

As our Red Team Engineer, you will attack our own products the way a capable adversary would: spacecraft, ground stations, cloud command-and-control software, and the pipelines and factory processes that produce them. You will run our internal assessments, lead the outside firms we bring in, build testing tools that keep up the pressure between assessments, and bring an attacker's perspective into design reviews while there is still time to change the design.

This is a hands-on engineering role, not an audit, compliance, or security policy role.

ABOUT THE TEAM

Apex builds spacecraft, the flight software that runs them, the ground systems and cloud software used to command them, and the test equipment and emulators used to develop them. In this industry a security failure can cost an entire mission, so we try to find the weaknesses before anyone else does.

Product Security is a small team with a big footprint. You would be its second core member, working directly with the Product Security Architect and alongside security engineers embedded in our flight software, ground software, and development infrastructure teams.

RESPONSIBILITIES

• Plan and run adversary emulation against our spacecraft, flight software, ground systems, and development pipeline, using SPARTA and MITRE ATT&CK to structure the work.
• Look for attack paths that cross system boundaries, such as a ground-system compromise that leads to control of a spacecraft, instead of testing each component in isolation.
• Lead our third-party security assessments: set the scope, give the testers the environments and engineering support they need, and bring their results together with our own.
• Design and build our fuzzing and automated testing capability, including agent-driven test generation, so testing runs with every release and not just once a year.
• Reverse engineer firmware and protocols, analyze embedded hardware interfaces, and review how cryptography is implemented.
• Join design reviews and technical trade-offs to show how a proposed design could be attacked before it is built

[…]
-person collaboration with amazing coworkers and flexibility to integrate work and life

• Real impact opportunity: Work alongside experts from aerospace, new space, and other cutting-edge industries to make a lasting difference

ADDITIONAL INFORMATION

Compensation ranges are set by role, level, location, and alignment with market data. A candidate's specific level and base pay are determined case by case and may vary with job-related skills, education, experience, technical capabilities, and internal equity. Beyond base salary, full-time hires are also eligible for long-term incentives in the form of stock options, along with medical, dental, and vision coverage and a 401(k) retirement plan.

ITAR REQUIREMENTS

Apex's work is governed by U.S. export control laws, including the International Traffic in Arms Regulations (ITAR) and the Export Administration Regulations (EAR). To be eligible for this role, applicants must either (1) qualify as a U.S. Person, meaning a U.S. citizen or national, a lawful permanent resident (green card holder), a refugee admitted under 8 U.S.C. § 1157, or an individual granted asylum under 8 U.S.C. § 1158, or (2) be able to obtain the required export authorizations from the U.S. Department of State, the U.S. Department of Commerce, or another applicable U.S. government agency. You can learn more about ITAR here https://www.pmddtc.state.gov/?id=ddtc_kb_article_page&sys_id=24d528fddbfc930044f9ff621f961987.

EQUAL OPPORTUNITY EMPLOYER

Apex Technology, Inc. is an Equal Opportunity Employer. We celebrate diversity and are committed to creating an inclusive environment for all employees. Candidates and employees are always evaluated based on merit, qualifications, and performance. We will never discriminate on the basis of race, color, gender, national origin, ethnicity, veteran status, disability status, age, sexual orientation, gender identity, marital status, mental or physical disability, or any other legally protected status.