Senior Security Engineer, Docker
€135.8-186.8k
+ Equity. Salary applicable to US applicants only, may vary for other location
More information about location
App development platform
Open for applications
App development platform
501-1000 employees
Open for applications
€135.8-186.8k
+ Equity. Salary applicable to US applicants only, may vary for other location
More information about location
501-1000 employees
Company mission
To increase the time developers spend on innovation, and decrease the time they spend on everything else.
Role
Who you are
- Have at least 5+ years of experience in security engineering roles, with a focus on application and infrastructure security, preferably in a cloud-native or SaaS environment
- Possess 3+ years of hands-on development experience in Python or Golang
- Demonstrate deep expertise in authentication, authorization, including technologies like OAuth, SAML, OIDC, MFA, cryptography applications and Zero Trust principals
- Have strong hands-on experience with securing cloud ecosystems (e.g: AWS, GCP, Azure)
- Understand AI/ML security risks and mitigations, including prompt injection, data poisoning, model extraction, and adversarial attacks
- Have deployed runtime security solutions for threat detection and policy enforcement in Kubernetes, Docker environments
- Have a track record of building security programs and automations from scratch, applying risk-based prioritization
- Have an understanding of compliance regulations (e.g, SOC 2, ISO 27xxx, GDPR, CCPA, FIPS) and ability to align security with compliance requirements
- Have excellent communication skills, allowing you to explain complex security concepts clearly to technical and non-technical stakeholders
- Understand industry standards, and actively keep up with emerging security technologies and models
- Are a team player who drives security change via collaboration and cross-functional partnerships
What the job involves
- As a Senior Security Engineer, you'll be a trusted advisor to engineering and product teams, ensuring security is built into every Docker product from the ground up
- You'll partner with leadership to shape product security strategy, influence architectural decisions, and drive adoption of security controls across the organization
- You'll apply your expertise in secure architecture, threat modeling, and vulnerability management to identify and mitigate risks early in the development lifecycle
- Working across cloud infrastructure (AWS, GCP, Azure), containerized environments, and AI/ML products, you'll implement proactive security solutions that scale with Docker's growth
- This role offers the opportunity to build and mature security programs at a company whose products are trusted by millions of developers worldwide
- You'll work in a fast-paced, technically challenging environment where your security expertise directly impacts both Docker's platform and the broader container ecosystem
- Work with leadership to align security initiatives with business goals, ensuring that security is a core component of product and infrastructure
- Take ownership and drive implementation for key programs such as vulnerability management, cloud governance, and product security
- Serve as a security subject matter expert for software security and architecture
- Partner with engineering to design and implement security architecture and controls across Docker products and platforms
- Perform security design reviews and threat modeling of emerging AI products
- Integrate security into SDLC through security requirements, design assessments, and automated security testing
- Manage Docker’s Vulnerability Disclosure Program (VDP) by validating submissions, and working with engineering to resolve confirmed issues
- Design and enforce security configurations in cloud environments (e.g. AWS, GCP, Azure) according to industry best practices
- Establish automated monitoring and alerting to detect security anomalies across our environments
- Serve on rotating on-call schedule to respond to security incidents, investigate threats, and coordinate remediation efforts
- Educate and collaborate with cross-functional teams (e.g., engineering, product) to promote security practices
- First 30 days:
- Meet with security team and key partners across engineering
- Gain access to team owned systems, and internal documentation
- Complete security awareness training and compliance onboarding
- Review application architecture, tech stack and data flow
- Review risk registry and annual roadmap
- Familiarize oneself with team workflows and processes
- Shadow a fellow security engineer during their on-call/secops rotations
- First 90 days:
- Conduct security review on emerging Docker products
- Actively participate in architecture design reviews with the team
- Be the Tech Lead for a Security owned project/initiative
- Collaborate with Docker developers to validate and resolve discovered vulnerabilities
- Enhance incident response capabilities by participating in on-call rotation and post-incident activities
- Effectively manage submissions to our Vulnerability Disclosure Program (VDP)
- Create and maintain security documentation and runbooks
- First Year Outlook:
- Execute security roadmap for improving security controls
- Strengthen Zero Trust architecture and least privilege access controls
- Enhance security monitoring and anomaly detection
- Perform security reviews for major product releases
- Conduct a penetration test or engage with external researchers
- Support audits and ensure compliance with SOC 2, ISO 27xxx
- Advocate for “security by design” in all product features
- Lead security awareness campaigns and company-wide security events
Our take
Docker supplies a hub and desktop solution to simplify the workflow of app development teams. Originally known for popularising the idea of containerising software, it saw itself outpaced by Kubernetes. However, the company has identified a problem with the growing complexity of containerisation, with some apps consisting of dozens or even hundreds of containers - which is what it now addresses.
Docker has had a difficult time in the recent past, with 2019 seeing it sell off its enterprise business, reduce its workforce by hundreds, and change its leadership team. As a well known brand and ecosystem for containerisation, however, it aims to lure developers back to its product as well as to take advantage of the growing global demand for app development.
Returning to focus on developers rather than large companies was certainly a gamble, but one that seems to have paid off. The company has returned to profitability and raised Series C funding in 2022, which is cited to fund hiring new talent, ramping up its business, and continuing to develop and refine its product. It's also embarked on a series of acquisitions to bolster its business, with speculation mounting about its possible sale in the near future.
Steph
Company Specialist at Welcome to the Jungle
Insights
47% employee growth in 12 months
Company
Funding (last 2 of 11 rounds)
Mar 2022
$105m
SERIES C
Mar 2021
$23m
SERIES B
Total funding: $498m
Company benefits
- 100% company paid medical premiums for employees and dependents
- Flexible Time Off Policy
- “Whaleness” Days — At least 1 company wide day off per month
- Employer Paid Holidays
- Generous Maternity and Parental Leave
- Home Office Set Up Budget
- Monthly Technology Stipend
- Training Allowances
- Life and Disability Insurance
- Retirement Plans
- Virtual and In-Person Social Events
- Docker Swag
- Quarterly Hackathons
- Virtual Coffee with Co-Workers
Company HQ
China Basin, San Francisco, CA
Leadership
Don Johnson
(CEO)Previously Executive Vice President of Infrastructure at Oracle, was a Principal Engineer at Amazon and a Lead Software Engineer at RealNetworks.
Share this job
View 36 more jobs at Docker