Kubernetes and Container Platform Security Specialist

Responsibilities: — Own the security design of Verda's Kubernetes offering, container registry, and registry credentials, including image provenance, signing, and admission verification requirements — Own the tenant isolation model on shared Kubernetes infrastructure: namespace, node and cluster boundaries, tenant reachability, and kubelet and API server exposure — Own the GPU-specific surface that most Kubernetes security work never touches: device plugins, privileged operator workloads, and partitioning boundaries — Define the Kubernetes hardening baseline across control plane, node OS, container runtime, etcd and secrets handling, and the policy and admission enforcement model behind it, expressed as policy-as-code so conformance is continuously observable — Design the Kubernetes network security model alongside Network Security: CNI-level policy, L3/L4/L7 controls, DNS and egress policy — Specify runtime detection requirements for the Security Operations Center to operate and triage, scope assessments and attack simulation for red teams to execute, and act on what both surface — Judge Kubernetes and container ecosystem advisories against Verda's configuration and set remediation priority, research new releases and ecosystem technology in a lab ahead of production adoption, and support Verda's compliance position through technical evidence and audit support Requirements: — Strong production Kubernetes and Linux experience, at a depth that lets you find problems rather than only configure around them — Direct experience of multi-tenant Kubernetes: shared clusters, untrusted workloads, isolation as a requirement rather than a nice-to-have — Deep understanding of Kubernetes architecture, the container runtime layer, and container and image security — Strong Kubernetes networking, including CNI-level policy design — Practical experience of policy-as-code and admission control, and working knowledge of software supply chain security: signing, provenance, SBOMs, and what admission-time enforcement actually requires