Senior Security Engineer, Docker
Docker Desktop
€113.9-186.8k
US Salary Range: $194,150 – $312,950. Offers equity
More information about location
App development platform
Be an early applicant
App development platform
501-1000 employees
Be an early applicant
€113.9-186.8k
US Salary Range: $194,150 – $312,950. Offers equity
More information about location
501-1000 employees
Company mission
To increase the time developers spend on innovation, and decrease the time they spend on everything else.
Role
Who you are
- 6+ years of experience in security engineering, application security, or a closely related discipline, with a track record at senior or staff level
- Bachelor’s degree in Computer Science, Engineering, or a related field, or equivalent practical experience
- Strong proficiency in Go, with the ability to review and contribute to production-grade code
- Deep understanding of Linux fundamentals relevant to container security: namespaces, cgroups, capabilities, seccomp profiles, AppArmor/SELinux, rootless containers, and privilege boundaries
- Solid grasp of OCI specifications and container runtime security (e.g. runc, containerd, BuildKit)
- Hands-on experience with identity and access management concepts: OAuth 2.0, OIDC, token handling, and auth flows in desktop or cloud-adjacent contexts
- Experience performing security design reviews, threat modeling, and participating in secure development workflows
- Familiarity with vulnerability management processes: CVE triage, CVSS scoring, coordinated disclosure, and working with external reporters
- Strong written and verbal communication skills; comfortable bridging the gap between a dedicated security team and a product engineering team
What the job involves
- As a Senior Security Engineer embedded in the Desktop engineering team, you will own the security posture of a complex, cross-platform product that sits at the intersection of identity, OCI runtimes, and Linux kernel internals
- You will be the team's primary security voice, reviewing features and code before they ship, partnering with our central security organization, and serving as the first line of triage for reported vulnerabilities
- This is a hands-on engineering role for someone who thinks in threat models and communicates clearly with both product engineers and security specialists alike
- Partner with engineering and product teams throughout the development lifecycle to identify security risks early, from design review through code review and release
- Conduct threat modeling and security design reviews for new and evolving product features, with particular focus on authentication, authorization, and container runtime security
- Serve as the team's primary liaison to the organization's security group, attending security syncs, relaying guidance, and translating central policy into practical engineering decisions
- Act as the first point of contact for incoming vulnerability reports and CVEs: validate severity, reproduce issues, coordinate disclosure timelines, and drive remediation with the relevant engineers
- Review Go code with a security mindset, identifying classes of issues such as privilege escalation, insecure defaults, injection risks, and improper credential handling
- Contribute security-focused improvements directly to the codebase where appropriate
- Develop and maintain internal security documentation, guidelines, and runbooks for the team
- Stay current on the Linux security landscape as it pertains to containers: namespaces, cgroups, seccomp, AppArmor, capabilities, and the evolving OCI ecosystem
- First 30 Days
- You will onboard into the team and get hands-on with the Docker Desktop codebase, architecture, and development workflow. You will meet your counterparts in the central security organization and learn how vulnerability reports are currently handled. The goal is to listen, ask questions, and build a clear picture of the product's current security posture, not to change anything yet
- First 90 Days
- You will be an active participant in design and code reviews, bringing a security lens to features in flight. You will have taken ownership of the vulnerability intake process, handling your first end-to-end triage cycles with minimal guidance. You will have a working relationship with the engineers on the team and a growing sense of where the most meaningful security investments should be made
- One Year Outlook (First Year)
- You will be the team's trusted authority on product security. You will have driven meaningful improvements to how the team approaches security across the development lifecycle, whether that's better threat modeling practices, improved auth flows, stronger container isolation defaults, or reduced time-to-remediation for reported issues. you will be a known presence in the broader security organization, and your work will be directly visible in the security and resilience of a product used by millions of developers every day
Our take
Docker supplies a hub and desktop solution to simplify the workflow of app development teams. Originally known for popularising the idea of containerising software, it saw itself outpaced by Kubernetes. However, the company has identified a problem with the growing complexity of containerisation, with some apps consisting of dozens or even hundreds of containers - which is what it now addresses.
Docker has had a difficult time in the recent past, with 2019 seeing it sell off its enterprise business, reduce its workforce by hundreds, and change its leadership team. As a well known brand and ecosystem for containerisation, however, it aims to lure developers back to its product as well as to take advantage of the growing global demand for app development.
Returning to focus on developers rather than large companies was certainly a gamble, but one that seems to have paid off. The company has returned to profitability and raised Series C funding in 2022, which is cited to fund hiring new talent, ramping up its business, and continuing to develop and refine its product. It's also embarked on a series of acquisitions to bolster its business, with speculation mounting about its possible sale in the near future.
Steph
Company Specialist at Welcome to the Jungle
Insights
47% employee growth in 12 months
Company
Funding (last 2 of 11 rounds)
Mar 2022
$105m
SERIES C
Mar 2021
$23m
SERIES B
Total funding: $498m
Company benefits
- 100% company paid medical premiums for employees and dependents
- Flexible Time Off Policy
- “Whaleness” Days — At least 1 company wide day off per month
- Employer Paid Holidays
- Generous Maternity and Parental Leave
- Home Office Set Up Budget
- Monthly Technology Stipend
- Training Allowances
- Life and Disability Insurance
- Retirement Plans
- Virtual and In-Person Social Events
- Docker Swag
- Quarterly Hackathons
- Virtual Coffee with Co-Workers
Company HQ
China Basin, San Francisco, CA
Leadership
Don Johnson
(CEO)Previously Executive Vice President of Infrastructure at Oracle, was a Principal Engineer at Amazon and a Lead Software Engineer at RealNetworks.
Share this job
View 29 more jobs at Docker