Staff Supply Chain Security Engineer, Docker

• 8+ years of backend engineering experience with production-grade systems
• Bachelor’s degree in Computer Science, Engineering, or a related field, or equivalent practical experience
• Deep expertise in the container and Kubernetes ecosystem - you have strong opinions about cert-manager, kyverno, grafana, istio, and similar projects, you've debugged them in production-shaped environments, and you can navigate upstream Helm chart source and project internals fluently
• Mastery of YAML as a working medium - you've designed conventions and structures that other engineers work within, not just authored within someone else's conventions
• Strong container security background - non-root users, UID/GID, image layers, multi-arch builds, and supply chain concepts (provenance, attestation, SBOM, signing) are second nature, and you can reason about tradeoffs at the catalogue level
• Go ability sufficient to design test infrastructure - you can write and review integration test code and shape the harness, even if you're not building distributed systems
• A maintainer mindset, applied at scale - you take pride in consistency, catch drift from patterns, and think about how a change to one image or chart ripples across dozens of others and out to customers
• Strong technical judgment in ambiguous situations - comfort making and defending decisions where there's no perfect answer (e.g., how aggressively to deviate from upstream, when to absorb a breaking change vs. pin)
• Track record of technical influence without authority - you've raised the quality bar on a team through review, design docs, mentorship, and well-chosen conventions
• Deep familiarity with GitHub-heavy open source workflows - PRs, upstream tracking, monorepo conventions, and the social side of engaging with upstream maintainers

Desirable

• Docker Hardened Images (DHI) is Docker's catalogue of security-hardened, enterprise-grade container images and Helm charts - built to be minimal, up-to-date, and safe to deploy in regulated and security-conscious environments
• We're looking for a Staff-level engineer to help shape the technical direction of this catalogue and raise the bar across the team that builds it
• This is not a traditional software engineering role. You'll spend most of your time working with YAML definition files, upstream OSS projects, and the container and Kubernetes ecosystems - packaging and adapting software rather than building it from scratch
• At the Staff level, you'll also own the harder, ambiguous problems: catalogue-wide architecture decisions, conventions that scale across dozens of images and charts, and the technical strategy that keeps DHI ahead of upstream change
• If you've led packaging efforts at a Linux distribution, driven Helm chart standards across an org, or operated as a Staff platform/security engineer at the intersection of supply chain, containers, and Kubernetes, this will feel familiar
• This is a pure individual contributor role - no direct reports. Influence comes through technical leadership, design, and mentorship
• Setting catalogue-wide technical direction - defining the conventions, patterns, and architectural decisions that govern how images and Helm charts are authored across DHI, and evolving them as the catalogue grows
• Owning the hardest packaging problems - images and charts with complex upstream dynamics (rapid release cadence, monorepo quirks, painful major-version breaks, intricate dependency chains, niche multi-arch issues) where the right answer isn't obvious
• Authoring and maintaining image definition files that track upstream OSS releases, define build steps, and keep the catalogue current - and shaping the templates and tooling others use to do the same
• Adapting upstream Helm charts (cert-manager, grafana, mongodb, kyverno, istio, and many more) to work with DHI images - handling security constraints, non-root contexts, and Kubernetes compatibility concerns, and codifying the patterns that make this repeatable
• Driving security hardening strategy - leading CVE triage approaches, hardening decisions, and supply chain posture (Sigstore, SBOM, SLSA) across the catalogue, not just individual images
• Designing and writing Go-based integration test infrastructure that validates images and charts behave correctly in real Kubernetes environments, and improving the harness others build on
• Raising the bar through review and mentorship - reviewing peers' definition and chart PRs, catching subtle issues before they reach customers, and helping other engineers grow into harder problems
• Partnering across teams with product, security, and customer-facing functions to translate customer needs and regulatory pressures into catalogue priorities and technical decisions
• Engaging upstream - representing DHI in upstream OSS communities (chart maintainers, project maintainers) on issues that affect security-hardened deployments
• Take part in the paid on-call rotation for the team; respond to incidents, debug production issues, and drive continuous improvement of system reliability