Senior Security Engineer, Docker
Governance, Risk, and Compliance
$201.6-252k
+ Equity
More information about location
App development platform
Be an early applicant
App development platform
501-1000 employees
Be an early applicant
$201.6-252k
+ Equity
More information about location
501-1000 employees
Company mission
To increase the time developers spend on innovation, and decrease the time they spend on everything else.
Role
Who you are
- Have 6 to 8 years of experience in Information Technology, Security Engineering, Governance, Risk and Compliance
- Will have familiarity setting up APIs and Webhooks, at least one scripting language, and at least one public cloud architecture and control tool
- Experience conducting security compliance reviews and audits for SaaS products and hosted environments including AWS and Azure
- Have strong knowledge of information security risk management and information security technologies (e.g: SIEM, vulnerability management, data loss prevention and /or endpoint protection)
- Thrive in fast-paced environments and can adapt quickly in the face of constantly evolving cybersecurity challenges
- Strong project management skills with the ability to lead and execute security assessment projects, vendor evaluations and initiatives on time with multiple stakeholders
- Enjoy fostering collaboration and cross-functional partnerships to help spread awareness and
- Build and implementation of cybersecurity controls
- Have experience in-depth knowledge and experience of cybersecurity frameworks including ISO 27001, 27701 and 27018
- Experience with the entire controls monitoring lifecycle, including identifying, assessing, monitoring, and remediating controls
- Excellent verbal and written communication skills with the ability to document, communicate, and report security assessments
- Serve as the subject matter expert and provide technical leadership and feedback for compliance / GRC projects
- Appropriately handling and managing confidential information including proprietary and trade secret information
- Stay up-to-date with changes in regulations, standards, and emerging regulatory requirements and ensure compliance
- Nice to Have: Relevant industry certifications such as CISSP, CISA, CRISC
What the job involves
- Docker is looking for a Senior Security GRC Engineer who will lead the development, implementation and maintenance of comprehensive GRC strategies
- A security engineer that works in security engineering and will automate control evidence gathering and continuous testing
- This role will mature the governance program by working alongside security engineering providing compliance and technical security control implementations across multiple software products, supporting infrastructure technologies, and business processes in alignment
- Lead the development, implementation and maintenance of comprehensive GRC strategies
- Build automated evidence gathering and continuous control testing through integrations maturing our governance program
- Establish partnerships with internal/external auditors, regulators, business stakeholders develop security requirements and controls
- Optimize security compliance monitoring and alerting systems; aggregate compliance alerts and advise on system policy violations
- Perform critical data security reviews over newly released products and features
- Ensure controls are operating effectively via assessment and attestation
- Own the vulnerability management program to identify and provide guidance for improvements
- Security Metrics - Uses automated and manual processes to produce relevant KPIs about the Information security program
- Policies and Procedures - Maintains corporate Information Security policies and departmental procedures and maps them to relevant control standards
- Recertification - Operates periodic processes to hire, transfer, and termination protocols are complied with and regular access reviews are conducted
- Security Awareness - Builds and maintains company awareness and education progress
- Risk Assessment - Builds and operates the company platform to document, measure, and report assessments, risks, controls findings, and remediation activity
- Draft policies and best practices that will be consumed by the entire organization
- Maintain knowledge of certifications and controls such as SOC 2, ISO 27001 / ISO 27018, and 27701
- Evaluate vendors against compliance and security standards
- What to expect in the first 30 days
- Advise on control design and build key partnership with control owners
- Document walkthroughs for all controls deemed ready in the current testing sprint
- Perform testing of all controls deemed ready in the current testing sprint
- Manage updates to the SOC 2 Jira Board to ensure accurate status is displayed
- Coordinate feedback and address comments for draft policies
- Complete vendor due diligence for new vendors onboarded
- What to expect in the first 90 days
- Provide feedback for the compliance roadmap
- Document walkthroughs for all for all controls deemed ready in the current testing sprint
- Perform testing of all controls deemed ready in the current testing sprint
- Manage updates to the SOC 2 Jira Board to ensure accurate status is displayed
- Create documented processes and procedures for Compliance team
- Help with implementation of vendor solutions and automation frameworks
- What to expect in the first year
- Complete walkthroughs for all SOC 2 controls
- Set up audit software to prepare for future audits
Our take
Docker supplies a hub and desktop solution to simplify the workflow of app development teams. Originally known for popularising the idea of containerising software, it saw itself outpaced by Kubernetes. However, the company has identified a problem with the growing complexity of containerisation, with some apps consisting of dozens or even hundreds of containers - which is what it now addresses.
Docker has had a difficult time in the recent past, with 2019 seeing it sell off its enterprise business, reduce its workforce by hundreds, and change its leadership team. As a well known brand and ecosystem for containerisation, however, it aims to lure developers back to its product as well as to take advantage of the growing global demand for app development.
Returning to focus on developers rather than large companies was certainly a gamble, but one that seems to have paid off. The company has returned to profitability and raised Series C funding in 2022, which is cited to fund hiring new talent, ramping up its business, and continuing to develop and refine its product. It's also embarked on a series of acquisitions to
Steph
Company Specialist at Welcome to the Jungle
Insights
47% employee growth in 12 months
Company
Funding (last 2 of 10 rounds)
Mar 2022
$105m
SERIES C
Mar 2021
$23m
SERIES B
Total funding: $497.9m
Company benefits
- 100% company paid medical premiums for employees and dependents
- Flexible Time Off Policy
- “Whaleness” Days — At least 1 company wide day off per month
- Employer Paid Holidays
- Generous Maternity and Parental Leave
- Home Office Set Up Budget
- Monthly Technology Stipend
- Training Allowances
- Life and Disability Insurance
- Retirement Plans
- Virtual and In-Person Social Events
- Docker Swag
- Quarterly Hackathons
- Virtual Coffee with Co-Workers
Company HQ
China Basin, San Francisco, CA
Leadership
Scott Johnston
(CEO, not founder)Has been COO and CPO with Docker prior to CEO role. Before that was VP, Marketing & Product at Puppet and a Venture Partner at Alloy Ventures.
Share this job
View 16 more jobs at Docker