Government/DoD security is much different than any random company's it security. Even large corps don't care about nationality for security team, just visa status / employment rules for most projects. (Again, when not related to gov projects)

I honestly don't know how SpaceX does what it does. (Update: they are regulated as working on military stuff so it's the same as DoD rules)