Staff Security Software Engineer, Stacklok
More information about location
Open source security technologies
Job no longer available
Open source security technologies
21-100 employees
Job no longer available
More information about location
21-100 employees
Company mission
To make it easier to securely develop software.
Role
Who you are
- Strong proficiency in software development and extensive experience with open-source projects
- Deep expertise in red teaming, penetration testing, and vulnerability assessments
- In-depth knowledge of software supply chain security, including understanding the risks associated with open-source components
- Familiarity with state-of-the-art tools and techniques used in red team operations and vulnerability assessments
- Proven track record of successfully identifying and exploiting vulnerabilities in complex systems
- Excellent written and verbal communication skills, with the ability to effectively convey technical concepts to diverse stakeholders
- Demonstrated leadership skills, with the ability to motivate and lead a team of security professionals
- Professional certifications such as Offensive Security Certified Professional (OSCP), Certified Ethical Hacker (CEH), or Certified Information Systems Security Professional (CISSP) are highly desirable
- Experience with Go and Javascript, and expertise with security protocols such as OAuth2, asymmetric / symmetric encryption, PKI / X509, secure cookies. Hashing algorithms such as Argon2, bcrypt
- Experience with Open source communities, for example OWASP, OpenSSF, Linux Foundation projects
What the job involves
- As the Red Team Software Engineer Lead, you will be at the forefront of securing our cutting-edge software supply chain solutions
- Reporting directly to the CTO, you will lead our red team operations, conduct penetration testing, and evaluate the overall security posture of our systems and infrastructure
- Lead Red Team Operations:
- Design, plan, and execute red team exercises to assess the security resilience of our software supply chain solutions
- Conduct comprehensive assessments of open-source projects, identifying vulnerabilities and potential supply chain attacks
- Collaborate with cross-functional teams to simulate real-world attacks, test defenses, and improve security measures
- Author threat models and map out attack vectors
- Stay current on the latest threats to the software supply chain, and work with engineering leadership and product management to ensure that the Stacklok product line is evolving to address emerging threat vectors
- Penetration Testing and Vulnerability Assessment:
- Perform rigorous penetration testing and vulnerability assessments on our software supply chain solution and the cloud configuration we use to deploy to our infrastructure
- Utilize advanced tools and methodologies to identify and exploit vulnerabilities in software components
- Automate CI driven security testing using SAST, and Fuzzing approaches
- Review code for security impact / risks
- Bug Bounty Program Management:
- Establish and manage a bug bounty program
- Engage with external security researchers and the open-source community to receive and triage vulnerability reports
- Evaluate and validate vulnerability findings, providing detailed reports
- Technical Leadership and Expertise:
- Serve as a subject matter expert in offensive security, specializing in open-source and software supply chain security
- Stay up to date with the latest attack techniques, tools, and industry best practices related to software security and supply chain
- Provide technical guidance, mentorship, and support to team members, fostering a collaborative and innovative environment
- This is a rare opportunity to join a startup at an early stage, and to be part of a team that is committed to building something truly innovative and impactful
Our take
Developers looking to actively work with open-source software face several barriers to entry in terms of accessing, integrating, and ultimately utilizing open-source technologies. In a bid to lower such barriers, Stacklok harnesses the power of open-source projects - like sigstore - to deliver enterprise-grade solutions to developers.
Software supply chain security is an absolute priority across software ecosystems, thus the necessity for a supply chain ledger with observability and transparency is paramount to building trust within the vast open-source ecosystem.
The experience of Stacklok’s Co-Founders – who have founded projects such as Kubernetes, sigstore, and Heptio (acquired by VMware) – and its impressive backing have the recently launched project well set to see accelerated growth and adoption.
Steph
Company Specialist at Welcome to the Jungle
Company
Funding (1 round)
May 2023
$17.5m
SERIES A
Total funding: $17.5m
Company benefits
- Flexible workplace: We offer fully remote and in-office positions, giving you the option to work from home full-time or for part of your week
- Healthcare packages: We offer medical, dental, and vision plans, including HSA options and coverage for dependents
- Flexible time off: Take time off to recharge or recover when you need it
- Non-linear workday: Piano recitals, doctor appointments, moving days—work around personal and family commitments
- Paid parental leave: We offer paid leave to recover and bond with your child
- Company equity: We offer compensation packages, so that you can benefit from our shared success
- Company holidays: Because we’re a global team, we dedicate time each year for everyone in the company to rest and recover
- Team offsites: We bring our global team together at team offsites for in-person collaboration
Company HQ
Central Business District, Seattle, WA
Leadership
Craig McLuckie
(CEO & Co-Founder)Founder & former CEO of Heptio. Previously worked as VP of R&D at VMware, Group/Lead Product Manager at Google, Lead Program Manager at Microsoft, and Entrepreneur in Residence at Accel.
Luke Hinds
(CTO & Co-Founder)sigstore Project Founder, OpenSSF Board Member, and Kubernetes Security Response Team member at CNCF. Former Distinguished Engineer at Red Hat.
Share this job