Senior Security Engineer, Docker
Privacy
$147.2-184k
Offers Equity
AWS
Docker
GCP
Python
Azure
Golang
Senior level
Remote from Canada, France, Germany, Spain, UK, US
More information about location
App development platform
Open for applications
App development platform
501-1000 employees
B2BInternal toolsSaaSDevOpsCloud Computing
Open for applications
$147.2-184k
Offers Equity
AWS
Docker
GCP
Python
Azure
Golang
Senior level
Remote from Canada, France, Germany, Spain, UK, US
More information about location
501-1000 employees
B2BInternal toolsSaaSDevOpsCloud Computing
Company mission
To increase the time developers spend on innovation, and decrease the time they spend on everything else.
Role
Who you are
- This is a highly impactful role for an engineer who thrives at the intersection of policy, code, and architecture, and who is passionate about building secure, privacy-respecting systems that protect both the platform and the customers who trust it
- 6–8 years of experience in information technology, security engineering, governance, risk and compliance, privacy engineering, or closely related roles
- Proven experience designing and implementing GRC programs with a strong emphasis on automation, engineering, and scalable processes
- Hands-on experience implementing or operating privacy programs aligned with GDPR and ISO/IEC 27701, including privacy-by-design and privacy-by-default principles
- Strong understanding of privacy engineering concepts such as data minimization, purpose limitation, data lifecycle management, and technical data protection controls
- Proficiency in one or more programming or scripting languages such as Python or Golang, with experience building automation for compliance and privacy workflows
- Experience working with APIs, webhooks, and integrating GRC, privacy, and security tooling
- Hands-on experience with public cloud environments (AWS, Azure, or GCP), including applying privacy and data protection controls across backup systems, data lakes, and distributed cloud storage services
- Experience integrating security and compliance requirements into SDLC and CI/CD pipelines using DevSecOps practices
- Solid understanding of security frameworks and regulatory standards such as ISO 27xxx, SOC 2, GDPR, and NIST, and how they apply to SaaS environments
- Knowledge of information security risk management and common security technologies (e.g., SIEM, vulnerability management, data loss prevention, endpoint protection)
- Experience conducting security risk assessments, data protection impact assessments (DPIAs), and translating findings into actionable remediation plans
- Strong project management skills with the ability to lead cross-functional initiatives involving engineering, product, legal, and compliance stakeholders
- Ability to communicate complex technical, privacy, and compliance concepts clearly to both technical and non-technical audiences
- Demonstrated ability to serve as a subject matter expert and trusted advisor on security, privacy, and compliance risks
- Ability to thrive in a fast-paced, evolving environment and adapt to changing regulatory and business requirements
- Nice to have: relevant industry certifications such as CISSP, CISA, CRISC, CIPP/E, CIPM, CIPT, or ISO/IEC 27701 Lead Implementer or Auditor
What the job involves
- As a Senior Security Engineer, Privacy, you will serve as a trusted advisor at the intersection of security, privacy, and engineering, ensuring governance, risk, compliance, and data protection are foundational to every product and platform
- You will collaborate closely with security engineering, engineering, product, legal, and leadership teams to embed security and privacy-by-design into Docker’s technology stack while scaling compliance with frameworks such as ISO/IEC 27001, ISO/IEC 27701, SOC 2, and global privacy regulations
- In this role, you will combine deep GRC expertise with hands-on privacy engineering and automation, developing scalable solutions that streamline compliance processes, improve risk visibility, and operationalize privacy controls
- You will design and maintain automated workflows for risk management, compliance monitoring, data protection assessments, and audit readiness, while influencing product strategy and technical design decisions
- Embed privacy-by-design principles into Docker products, services, and internal platforms, aligned with ISO/IEC 27001, ISO/IEC 27701, SOC 2, and global privacy regulations
- Partner closely with Docker engineering and product teams to integrate privacy requirements into architecture decisions, SDLC processes, and CI/CD pipelines
- Design, develop, and maintain automated GRC and privacy workflows to support compliance monitoring, control testing, DPIAs, risk assessments, reporting, and audit readiness
- Implement and customize GRC and privacy tooling using APIs, scripting, and automation to streamline evidence collection, control validation, and compliance operations
- Lead and automate data discovery, classification, and data mapping across Docker systems to maintain accurate Records of Processing Activities (RoPA) and support data lifecycle governance
- Conduct and operationalize security risk assessments and Data Protection Impact Assessments (DPIAs), integrating findings into Docker’s risk register and remediation tracking
- Define, implement, and validate data protection and data lifecycle controls, including data minimization, retention, deletion, and access controls
- Build and maintain dashboards and security/privacy metrics to provide real-time visibility into risk, compliance posture, and program effectiveness
- Support internal and external audits by providing high-quality, automated evidence and serving as a subject matter expert for security and privacy controls
- Draft, maintain, and map security and privacy policies, standards, and procedures to relevant regulatory and industry frameworks
- Conduct privacy reviews of existing and new products, features, and significant changes to ensure compliance requirements are met prior to release
- Build awareness and enablement across Docker by educating teams on security, privacy, and compliance expectations and best practices
- Stay current with evolving regulatory, privacy, and security standards and proactively assess their impact on Docker’s products and operations
- First 30 days:
- Learn Docker’s compliance landscape, key frameworks and risk posture
- Meet with key stakeholders: Security, Legal, IT and Engineering teams
- Gain access to compliance platforms, security tools and documentation
- Review company policies, existing controls, and regulatory frameworks
- Understand risk management strategies and how compliance is integrated into engineering, security and business operations
- First 90 days:
- Conduct a maturity assessment of the compliance program to assess how well policies are being followed
- Begin a risk assessment project (vulnerability management, cloud security risks)
- Review the latest internal/external audits, compliance reports, and gap analyses
- Identify high-priority risks, open compliance issues, and pending security assessments
- Begin mapping key compliance frameworks to the organization’s policies and controls
- Understand vendor risk management processes and review third-party security assessments
- Work with engineering teams to integrate privacy & compliance controls into do the SDLC
- Update policies or controls to align with compliance frameworks
- One-year Outlook:
- Become the leader of compliance engineering
- Own and manage the Compliance GRC roadmap
- Automate compliance monitoring and controls
- Start contributing to audit preparation or certification processes (SOC 2, ISO 27xxx)
- Improve compliance automation within security engineering
- Develop and maintain a Compliance Risk Register with mitigation plans
- Support audit readiness (SOC 2, ISO 27xxx)
- Ensure third-party vendors meet compliance standards
- Create incident response playbooks for compliance standards
- Prepare the company for external audits and regulatory updates
- Drive a culture of compliance by advocating for security best practices in engineering
Our take
Docker supplies a hub and desktop solution to simplify the workflow of app development teams. Originally known for popularising the idea of containerising software, it saw itself outpaced by Kubernetes. However, the company has identified a problem with the growing complexity of containerisation, with some apps consisting of dozens or even hundreds of containers - which is what it now addresses.
Docker has had a difficult time in the recent past, with 2019 seeing it sell off its enterprise business, reduce its workforce by hundreds, and change its leadership team. As a well known brand and ecosystem for containerisation, however, it aims to lure developers back to its product as well as to take advantage of the growing global demand for app development.
Returning to focus on developers rather than large companies was certainly a gamble, but one that seems to have paid off. The company has returned to profitability and raised Series C funding in 2022, which is cited to fund hiring new talent, ramping up its business, and continuing to develop and refine its product. It's also embarked on a series of acquisitions to bolster its business, with speculation mounting about its possible sale in the near future.
Steph
Company Specialist at Welcome to the Jungle
Insights
Top investors
47% employee growth in 12 months
Company
Funding (last 2 of 11 rounds)
Mar 2022
$105m
SERIES C
Mar 2021
$23m
SERIES B
Total funding: $498m
Company benefits
- 100% company paid medical premiums for employees and dependents
- Flexible Time Off Policy
- “Whaleness” Days — At least 1 company wide day off per month
- Employer Paid Holidays
- Generous Maternity and Parental Leave
- Home Office Set Up Budget
- Monthly Technology Stipend
- Training Allowances
- Life and Disability Insurance
- Retirement Plans
- Virtual and In-Person Social Events
- Docker Swag
- Quarterly Hackathons
- Virtual Coffee with Co-Workers
Company HQ
China Basin, San Francisco, CA
Leadership
Don Johnson
(CEO)Previously Executive Vice President of Infrastructure at Oracle, was a Principal Engineer at Amazon and a Lead Software Engineer at RealNetworks.
Share this job
View 36 more jobs at Docker