Director of Security, Docker

• 10+ years of experience in security engineering and/or engineering
• 4+ years experience leading engineering teams and familiarity with agile development and security
• Knowledge and experience implementing secure coding best practices
• Experience with AWS
• Experience with Terraform or other cloud configuration tools
• Understanding of security nuances in cloud-native container-based systems
• Fundamental knowledge of encryption and best practices
• Have participated in SOC2, ISO 270001 or equivalent compliance prep and audits
• Experience in Vendor management

Desirable

• The Director of Security will help Docker enable the growth of Docker’s products with a Security first mindset
• The Security team enables the secure design and engineering of Docker’s products and secures Docker’s systems and tools with the goal of exceeding security standards, compliance, and audit requirements
• We are an enabling team of Security Engineers, not analysts
• As a member of this team, you will work closely with all Docker’s engineering teams in determining the overall security strategy for Docker products
• You will also manage systems and processes that keep Docker safe
• This is a cross-functional role that spans security engineering, corporate security and security operations
• Manage Docker’s cross-functional Security Engineering team
• Drive the Security Engineering Roadmap and adoption across all Docker departments
• Set team goals and objectives, conduct regular one-on-one meetings with direct reports
• Set the security posture and processes responsible for keeping Docker safe
• Drive enhancements and improvements to security processes
• Participate in code reviews, vulnerability remediation, and larger scale engineering projects to help improve security posture, automation, controls, offensive security/red teaming
• Be a liaison to internal customers and the wider organization, making sure they have the resources and knowledge to maintain our security standards
• Partner with the Governance, Risk and Compliance team to find a best fit in enforcing compliance and audit controls while assuring engineering velocity
• What to expect in the first 30 days:
• Understand how Product Security fits into the wider organization
• Lead Security Engineering team in executing critical initiatives and projects
• Schedule 1-on-1’s with each direct report
• Get to know each team member
• Meet and gather feedback from key leaders from the teams we support
• Build a high level understanding of the existing product security plans and guide the team through execution
• What to expect in the first 90 days:
• Develop a team roadmap for the next quarter
• Reporting progress regularly to leadership
• Set career goals with team members and start working towards them
• Participate in Incident response
• Meet regularly with engineering managers
• Drive one adoption of a security primitives and/or best practice across the company
• What to expect in the first year:
• Further Docker’s initiative of security first throughout engineering
• Lead Docker’s Product Security team initiatives
• Have demonstrable results on team career development and team happiness / effectiveness