Staff Site Reliability Engineer, Platform Security

Description:
This team manages multiple functions across Tesla that includes Platform Engineering, Devops, MLOps, Cloud Infrastructure (AWS, Azure, GCP), Factory SRE as well. Continued development and automation of deployment, monitoring, self-healing and alerting processes is imperative to the success of our engineering groups. We’re seeking an expert level Kubernetes Security Engineer with SRE background to lead end-to-end security transformation across our entire kubernetes cluster estate, tooling, and CI/CD automations.

Responsibilities:
Conduct comprehensive security audits across all Kubernetes clusters, identifying RBAC misconfigurations, overprivileged service accounts, and policy gaps
Design and implement RBAC strategy enforcing principle of least privilege (PoLP) across all clusters, namespaces, and workloads with granular role definitions and access controls
Establish continuous audit and compliance monitoring using admission controllers (OPA/Gatekeeper, Kyverno), audit logging, and runtime security tooling to detect and prevent policy violations
Harden container and pod security by implementing Pod Security Standards (PSS/PSA), security contexts, network policies, and eliminating privileged containers and root execution
Secure software supply chain through image scanning, signing (Sigstore/Cosign), SBOM generation, admission webhooks, and private registry governance
Deploy cluster-wide security mitigations at scale using GitOps workflows, policy-as-code, and automated remediation across the entire cluster fleet
Implement network segmentation and zero-trust architecture using service mesh, network policies, mTLS, and microsegmentation to limit blast radius
Build secrets management infrastructure migrating from in-cluster secrets to external vaults (HashiCorp Vault, AWS Secrets Manager) with dynamic credential rotation
Collaborate with Infosec and red team on threat detection and automated incident response playbooks
Security tooling standardization and automation, creating reusable Helm charts, Terraform modules, and CI/CD pipelines for consistent security posture across all clusters

Requirements:
7+ years of Kubernetes security experience with proven track record securing large-scale, multi-cluster production environments
Deep RBAC expertise including ClusterRoles, RoleBindings, service account management, and complex multi-tenant authorization models
Active contributor to major open-source container security projects (e.g., Falco, Open Policy Agent, Trivy, Kubescape, KubeArmor, Cilium, or CNCF security projects) with verifiable GitHub contributions
Expert-level knowledge of Kubernetes security primitives: Pod Security Standards, SecurityContext, NetworkPolicies, admission controllers, audit logging, and CIS benchmarks
Hands-on experience with security tooling: OPA/Gatekeeper, Kyverno, Falco, Trivy, Aqua Security or similar platforms
Strong automation and IaC skills: Terraform, Helm, GitOps (ArgoCD/Flux), Python/Go for building security automation and policy-as-code frameworks
Container security expertise: Image hardening, vulnerability management, supply chain security (SLSA, SBOM, Sigstore), and rootless/distroless containers
Experience deploying changes at scale across distributed cluster fleets using multi-cluster management tools (Rancher, Anthos, EKS Anywhere, Cluster API)
Strong incident response and forensics background in containerized environments, including experience with eBPF-based monitoring, log analysis (ELK/Splunk), and breach containment strategies

Compensation & Benefits:
Benefits

Along with competitive pay, as a full-time Tesla employee, you are eligible for the following benefits at day 1 of hire:
Medical plans > plan options with $0 payroll deduction
Family-building, fertility, adoption and surrogacy benefits
Dental (including orthodontic coverage) and vision plans, both have options with a $0 paycheck contribution
Company Paid (Health Savings Accounts) HSA Contribution when enrolled in the High-Deductible medical plan with HSA
Healthcare and Dependent Care Flexible Spending Accounts (FSA)
401(k) with employer match, Employee Stock Purchase Plans, and other financial benefits
Company paid Basic Life, AD&D
Short-term and long-term disability insurance (90 day waiting period)
Employee Assistance Program
Sick and Vacation time (Flex time for salary positions, Accrued hours for Hourly positions), and Paid Holidays
Back-up childcare and parenting support resources
Voluntary benefits to include: critical illness, hospital indemnity, accident insurance, theft & legal services, and pet insurance
Weight Loss and Tobacco Cessation Programs
Tesla Babies program
Commuter benefits
Employee discounts and perks program