Вакансии

Location: Seattle, WA Workplace: Remote ABOUT DOCKER Docker has been one of the most loved brands in developer tooling, trusted by more than 20 million monthly users and over 20 billion container image pulls. From solo founders to the world's largest companies, developers rely on Docker to build, share, and run their applications across our suite of products including Docker Desktop, Docker Hub, and Docker Scout. We are a globally distributed, remote-first team building the tools that define how software gets built and delivered. As AI agents redefine software development, Docker is at the center of that shift, providing the sandboxed environments, verified images, and secure infrastructure that make autonomous workflows trustworthy by default. _______________________________________________________________________ THE OPPORTUNITY Docker is seeking a Senior Principal Engineer to serve as the technical visionary and architect for how software gets built, verified, and trusted. Every day, millions of developers pull images, install dependencies, and ship builds to production. Each of those steps is a place where something can go wrong, or be made to go wrong. Compromised base images, malicious packages, tampered build steps, unsigned artifacts moving through pipelines nobody is watching. The industry calls this the software supply chain, and it has become one of the most consequential unsolved problems in software engineering. This role sits in Docker and Ecosystems, the group that owns Docker’s most well known products and our emerging content and SDLC business. You will own the technical strategy for secure software delivery across all of it, defining what verifiable, tamper-resistant software delivery looks like at Docker's scale, then driving the architecture that makes it real for every developer and every enterprise customer using our products. You will set multi-year technical direction, make architectural decisions that shape Docker's product portfolio, and work directly with the SVP of Engineering and executive team on strategy. You will not manage people. You will change what the industry considers table stakes. WHAT YOU'LL DO TECHNICAL VISION AND STRATEGY - Lead multi-year technical vision for build security and supply chain across Docker Desktop, Hub, Hardened Images, Verified Publishing, and monetization platforms. - Define and sequence "trusted by default" architecture for 20M developers. - Partner with the SVP of Engineering to convert commercial strategy into multi-year technical roadmaps. - Establish company-wide architectural principles and security standards. - Identify high-leverage platform investments that enhance security across all Docker products. - Proactively position architecture ahead of evolving supply chain threats and regulatory demands. BUILD SECURITY ARCHITECTURE Architect systems to detect and prevent build-process threats like compromised dependencies, malicious steps, tampered artifacts, and untrusted images. - Design provenance and attestation infrastructure ensuring Docker artifacts carry verifiable build history. - Define artifact signing, verification, and policy enforcement across local workflows and CI/CD pipelines. - Architect SBOM generation, dependency analysis, and vulnerability intelligence for complete software visibility. - Align with and help shape emerging supply chain security standards. - Ensure security controls remain fast and unobtrusive so developers keep them enabled. SDLC AND DEVELOPER WORKFLOW INTEGRATION - Architect how Docker's security capabilities integrate across the full software development lifecycle, from local development through CI/CD to production deployment - Design the interfaces and contracts that let Docker's tooling embed into the pipelines, registries, and platforms customers already run, rather than asking them to rebuild around us - Define the developer experience for security tooling, where the secure path is the fast path and the default path - Architect policy and enforcement models that satisfy enterprise security and compliance requirements without fragmenting the developer workflow - Drive convergence of security capabilities across Docker products, replacing product-specific implementations with shared platform primitives TECHNICAL EXCELLENCE AND INFLUENCE - Work with leaders across engineering to drive strategy and execution - Mentor and develop Staff and Principal engineers, raising the technical bar across the organization - Represent Docker's security architecture externally through blog posts, conference talks, standards bodies, and technical community engagement - Participate in executive-level discussions, providing architectural perspective on business decisions - Take part in on-call rotation for your team, respond to incidents, debug production issues, and drive continuous improvement of system reliability WHAT YOU'LL BRING DOMAIN EXPERTISE - 12+ years of software engineering experience specializing in build security, software supply chain security, or SDLC tooling - Deep understanding of build process threat models across dependencies, environments, artifacts, and pipelines, along with effective mitigations - Architectural experience in artifact signing, attestations, SBOMs, dependency security, CI/CD security, base image trust, or vulnerability intelligence - Practical knowledge of supply chain security frameworks and standards - Expertise in API design, service architecture, and scalable system integration - Proven record delivering large-scale distributed systems for millions of users and enterprise customers - Experience with major cloud platforms (AWS, GCP, Azure) and modern infrastructure - Bachelor's degree in CS, Engineering, or equivalent practical experience STRATEGIC AND BUSINESS IMPACT - Proven track record creating strategic technical plans that enable revenue, expansion, or enterprise deals - Experience converting business strategy into technical architectures and roadmaps - Understanding of SaaS business models, enterprise sales, and how security impacts commercial outcomes - Experience leading build-vs-buy decisions for core platform components LEADERSHIP AND INFLUENCE - Ability to lead large, cross-company technical initiatives across multiple engineering teams - Experience partnering with VPs and executives to define and execute technical strategy - Proven ability to influence technical direction and build consensus without direct authority - Strong communication skills for presenting to executives and driving organization-wide alignment - Experience mentoring senior engineers and developing technical leaders ENTERPRISE CONTEXT - Experience building products that serve enterprise customers with complex security and compliance requirements - Knowledge of enterprise security requirements and compliance frameworks such as SOC 2 and ISO 27001, and their architectural implications - Understanding of how enterprise security teams evaluate, procure, and operate tooling PREFERRED - Scale experience at a security, developer tools, or infrastructure software company - Experience with containers (Docker, Kubernetes) or developer platforms - Experience with complex enterprise billing, contracts, usage pricing, and revenue recognition - Proven ability to migrate legacy systems without disrupting business operations - Contributions to open-source security tools or supply chain security standards - Recognized technical leader via speaking, publishing, or open-source work - Advanced degree in CS, Engineering, or a related field WHAT SUCCESS LOOKS LIKE Security Posture - Artifacts produced through Docker carry verifiable provenance by default, not by opt-in configuration - Build-time threat classes are addressed architecturally rather than through detection after the fact - Developers keep security controls enabled because the controls are fast and unobtrusive Business Enablement - Security and governance capabilities directly unblock enterprise revenue - New product SKUs launch in weeks instead of months through the billing platform - Usage-based billing supports monetization of new security and AI product lines Platform Leverage - Product teams ship enterprise-ready, secure-by-default features in under two weeks rather than months - Shared security primitives replace fragmented per-product implementations - Platform systems achieve 99.9%+ uptime for business-critical workflows Organizational Impact - Recognized across Docker as the definitive technical authority on build and supply chain security - Multiple Staff and Principal engineers developed who can own major domains - Docker's voice carries weight in the external supply chain security conversation Docker considers visa sponsorship on a case-by-case basis based on business needs.   Compensation & Equity United States: $219K – $352K + equity ______________________________________________________________________ POSTING INFORMATION - Open vacancy: This posting is for an existing open role. - AI in hiring: Docker may use AI-assisted tools during our recruiting process. - Interview recordings: Candidates will be invited to opt in to interview recordings to support interviewer calibration and consistent evaluations. Recordings are optional and require explicit consent. ______________________________________________________________________ PERKS & BENEFITS - Remote-first by design – Work from your home, with offices in Seattle and Paris for connection and collaboration. - Flexibility that fits your life – We trust you to manage your schedule while delivering great work. - Time to recharge – Generous PTO, designated quarterly Whaleness Days, and a designated end-of-year Whaleness break. - Home office support – Set up your workspace for comfort and success. - Technology stipend – Equivalent to US$100 net per month to help support your work. - Learning & development – Annual stipend for conferences, courses, certifications, and continued learning. - Parental leave – 16 weeks of paid parental leave after six months of employment. - Equity for all full-time employees – Share in Docker's long-term success as we continue to grow. - Comprehensive benefits – Medical, retirement, and paid holidays vary by country. - Docker swag – Because representing the whale never gets old. Docker is proud to be an equal opportunity employer. We are committed to building a team that reflects a broad range of backgrounds, experiences, and perspectives. We believe diverse teams build better products, make better decisions, and better serve our global community. #LI-REMOTE

Зарплата не указана

Shakepay is looking for a Staff Security Engineer to design scalable security solutions, automate detections and response workflows, lead incident response, and strengthen AI-enabled security capabilities.

225 000 – 275 000 $

Within this, you will: Own features of the OpenZeppelin Contracts Library for Daml end to end, from design through audit: examples include a Timelock, access control, vaults, or token standard support. Implement and shepherd the OZ Daml versions of CIP-56, CIP-86, CIP-103, future CIPs.

Зарплата не указана

* Own outbound prospecting and pipeline creation for a defined set of accounts. * Research target accounts and decision-makers using tools like ZoomInfo and LinkedIn Sales Navigator.

3 000 – 3 500 €

Location: Remote - US West About the Job: We're looking for a senior security leader to run our Product Security team and partner to the Director of Security. In this role, you'll own how Security operates: a program led by risk rather than audit calendars, where engineering teams own their security health and Security informs, guides, and validates, where automation and AI take the first pass on every finding, and where posture is measured and published to executives every quarter. You'll build that model, starting with Product Security and extending across the division. You'll bring a balance of people management, security judgment, and program leadership as you manage a team of security engineers, act as incident manager of record, hold delegated approval for vendor and access decisions, and run the division when the Director is in an audit, a board cycle, or on vacation. You'll work closely with every engineering team to make the secure path the easy one. Responsibilities: Manage the portfolio of your team's work, appropriately managing everyone's time and assigning them to the highest priority work. Help your team and the engineering organization make sense of, and simplify, how security work gets done: who owns what, what is automated, and what Security stops doing. Guide product engineering teams in owning their own security health: findings route to them with mapped severity, Security reviews and validates rather than fixes, and each team sees its security health in its own service review. Own the wiring and routing of security findings and requests, driving down noise and the human-decision rate across intake, triage, and review. Serve as incident manager of record for security incidents: first escalation for our service-level commitments, delegated approver for vendor and access decisions, and cover for the Director's operational duties. Publish posture: monthly service-level attainment to engineering, quarterly posture to the executive team, and a risk register that drives priorities. About You: You have led a security team out of the gatekeeper model once already, and you can say what teams owned afterward, what Security stopped doing, and what the numbers did. You think in risk, not control lists, and you would rather defend a priority call than a checklist. You treat automation and AI as the first responder and yourself as the escalation path. You have been the second leader to a director or CISO and know which decisions to make in their name. You have run security incidents end to end, including the comms and the review afterward. You were a strong Senior or Staff security engineer before you managed, and you can still read a PR, a threat model, or a cloud finding and make a call. You track and drive metrics, and you understand what they can and can't tell you. Qualifications: 5+ years of experience in a formal security or engineering management role, including managing senior engineers. Experience moving a security function from gatekeeper to team ownership, with measurable results. Experience as incident manager for security incidents at a SaaS company, including external communication. Experience guiding teams through technical tradeoffs and developing senior engineers' careers. The ability to track and drive metrics, and the wisdom to understand what they can and can't tell you. Familiarity with AWS security at scale and with external audits (SOC 2, ISO 27001, or FedRAMP) as a participant or control owner. Excellent communication skills with both technical and non-technical stakeholders. A thoughtful, empathetic approach to leadership and collaboration. Pay: Target pay ranges based on Geographic Zones* for Level M3: Zone 1: San Francisco/Bay Area or NYC Metropolitan Area, Boston, Seattle - $240,600 - 330,700* Zone 2: Irvine, LA, Monterey, Santa Barbara, Santa Rosa, Austin, Portland, Philadelphia, Chicago - $216,500 - 297,600 ** Zone 3: All other US locations - $ 204,500 - 281,100 ** All Zones Inclusive of 15% Bonus Target LaunchDarkly operates from a place of high trust and transparency; we are happy to state the pay range for our open roles to best align with your needs. Exact compensation may vary based on skills, experience, and location. *Within the United States, our geographic pay zones are defined by counties surrounding major metropolitan areas. **Restricted Stock Units (RSUs), health, vision, and dental insurance, and mental health benefits in addition to salary. About LaunchDarkly: Modern software delivery was supposed to be the foundation for a thriving digital business but reality has proven otherwise. Slow, inefficient development cycles, costly outages, and fragmented customer experiences are preventing developers from building their best software. The LaunchDarkly platform helps developers innovate on new features faster while protecting them with a safety valve to instantly rewind when things go wrong. Developers can target product experiences to any customer segment and maximize the business impact of every feature. And by gradually rolling out new application components, they escape nightmare "big-bang" technology migrations. The LaunchDarkly platform was built to guide engineers to the next frontier of DevOps by: Improving the velocity and stability of software releases, without the fear of end customer outages Delivering targeted experiences by easily personalizing features to customer cohorts Maximizing the business impact of every feature through the ability to experiment and optimize Coordinating the release and optimization of software to provide consistent experiences across mobile platforms and device types Improving the effectiveness and productivity of engineering teams, by providing insights into engineering cadence and stability At LaunchDarkly, we believe in the power of teams. We're building a team that is humble, open, collaborative, respectful and kind. We are an equal opportunity employer and value diversity at our company. We do not discriminate on the basis of race, religion, color, national origin, gender, gender identity, sexual orientation, age, marital status, veteran status, or disability status. LD invites any applicant to review our written Affirmative Action Plan. To do so, contact People Ops at hr@launchdarkly.com . Do you need a disability accommodation? Fill out this accommodations request form and someone from our People Operations team will contact you for assistance. Your safety matters to us. To protect yourself from potential scams, LaunchDarkly recruiters will only contact you from @LaunchDarkly .com email addresses or via LinkedIn from "Verified Recruiter" accounts. Be cautious of emails from other domains.  Legitimate LaunchDarkly recruiters will never ask for money, fees, or banking information before making a job offer. LaunchDarkly will never make a job offer without conducting a formal interview process. Our interview process does not involve asking detailed questions by email. If you are ever unsure about a communication that you receive, don't click any links—visit Careers | LaunchDarkly directly for confirmed job openings and links to apply. Please notify us of any fraudulent representation by sending an email to careers@launchdarkly.com .

* Run travel risk management for employees: pre-travel risk assessments, real-time monitoring, and on-the-ground assistance across all destinations. * Lead ICEYE's response to security crises, coordinating internal teams and external partners to resolve situations quickly and limit the impact on people and operations.

Зарплата не указана

Встраивать и сопровождать процессы SSDLC / DevSecOps в CI/CD. Настраивать и развивать инструменты SAST, DAST, SCA, Secret Detection, снижать количество ложных срабатываний.

Зарплата не указана

Own the technical strategy for complex Enterprise opportunities from initial discovery through POV, onboarding, and the customer's first 30 days. Lead POVs end to end by defining meaningful success criteria, building the technical delivery plan, coordinating internal teams, troubleshooting issues, and keeping execution on track.

186 000 – 195 000 $

Location: USA - Remote Workplace: Remote About Us Since 2013, we’ve been building a CRM that gets out of your way and helps your team sell more, faster. Now we’re building AI into every part of it, so Close does the busywork and your team does the selling. No manual data entry, no 10-click workflows. Just communication-first, AI-powered sales software designed to help you succeed and scale. We're bootstrapped and profitable which means we answer to our customers and play by our rules. We're proud of our 120-person, 100% remote team, focused on building Close so that no small, scaling business fails because it can't figure out sales. ABOUT THE ROLE Close is a CRM built around the communication tools sales teams use every day: email, calling, SMS, workflows, reporting, and AI. Underneath that product is a broad technical surface — Python services and a large application backend, a TypeScript and React frontend, public APIs, Docker and Kubernetes, AWS infrastructure, and integrations with providers that handle sensitive customer data. Security work happens across it all today, but the ownership is spread across Engineering, Infrastructure, and Security & Trust. We’re hiring our first dedicated Product Security Engineer to make that work systematic. You’ll report to the Backend Platform team manager within EPD (Engineering, Product, and Design), while working across the entire product and infrastructure surface. You’ll find vulnerabilities, determine which findings matter most, and drive them through remediation. Often you’ll fix the problem yourself. Other times you’ll give the owning team a clear reproduction, a practical path forward, and enough context to prioritize correctly. You’ll analyze code, build proof-of-concepts, test running applications, tune or replace noisy tools, and automate the repetitive parts of vulnerability management. This is not a role where you forward scanner alerts and call the queue managed. Product and application security will be your responsibility. You’ll partner closely with our Infrastructure team on cloud security, access, and secrets, and with our Security & Trust Lead on GRC Engineering https://grc.engineering/, compliance (SOC 2) goals, audits, and corporate security. This role is a new one at Close. You’ll have significant room to decide where better tooling, clearer ownership, and a small amount of code can reduce the most risk. OUR STACK Our backend is primarily Python, with Flask and FastAPI services and TaskTiger https://github.com/closeio/tasktiger and Temporal handling much of our asynchronous work. We expose REST https://developer.close.com/ and GraphQL APIs and store data in MongoDB, PostgreSQL, Elasticsearch, and Redis. Our frontend is a large single-page TypeScript application built primarily with React. We bundle with Vite, target modern browsers, and test with Vitest, React Testing Library, Playwright, and Chromatic. The product updates in near real time and uses technologies including WebSockets and WebRTC. Our mobile application is built with React Native. We build and test Docker images in CI/CD and continuously deploy them to Kubernetes on AWS. Our infrastructure uses managed services including EKS, MSK, and ElastiCache, alongside services running on EC2. Terraform and Ansible automate much of the underlying infrastructure, and our containerized local development environment lets engineers run the full system on their own machines. For this role, our stack extends beyond simply backend or frontend: browser behavior, frontend state, API authorization, asynchronous processing, data access, third-party integrations, containers, and cloud configuration can all be part of the same attack path. We love open sourcing our code and ideas on our GitHub https://github.com/closeio and on The Making of Close https://making.close.com/, our behind-the-scenes Product & Engineering blog. Check out our open source projects like SocketShark https://github.com/closeio/socketshark, TaskTiger https://github.com/closeio/tasktiger, LimitLion https://github.com/closeio/limitlion and ciso8601 https://github.com/closeio/ciso8601. AI is both how we build and what we ship, and that's reshaped what engineering looks like. This is a transformation we’re embracing and find deeply exciting. YOU ARE - An application security engineer who writes code. You can move from reading an unfamiliar code path, to reproducing an exploit, to proposing or shipping a production-quality fix. Strong Python or TypeScript experience would be especially useful; fluency across both backend and frontend systems is even better. - Skilled at finding vulnerabilities conventional scanners may miss. You use modern AI-assisted review pipelines, guided by expert judgment, to uncover subtle flaws in web apps and APIs—from authentication, authorization, and tenant isolation to injection, SSRF, unsafe data flows, and business logic. You can threat-model designs, white-box review code, and test running systems. - Offensive-minded and operationally responsible. You know how to test like an attacker without being careless with customer data or production systems. You can turn a finding into a safe reproduction, assess exploitability and business impact, and retest the eventual fix. - An automation builder. You have worked with some mix of SAST, DAST, software composition analysis, container scanning, secrets scanning, or cloud posture tooling. More importantly, you know how to tune tools, connect them to engineering workflows, and remove noise. - AI-native and accountable. You use coding agents and LLMs to accelerate investigation, code review, and repetitive engineering work, but you verify their output. You think carefully about what happens when agents clone untrusted code, install dependencies, or receive access to credentials. - Able to separate severity from priority. A score is an input, not a foregone conclusion. You consider reachability, existing controls, customer impact, and attack chains, then explain the risk in language that is legible to an engineer or business owner. - Comfortable working across the business. You’ll collaborate with product engineers, Site Reliability Engineers, Security & Trust Lead, auditors, and external researchers without confusing partnership for pass-off ownership. You will follow findings to closure even when another team is responsible for the fix. - Self-directed in a remote environment. You can take an ambiguous surface (say, secret rotation or dependency remediation) and learn how it works across multiple systems then turn it into a practical plan with measurable progress. You do not need to arrive as the deepest expert in every part of this scope. You do need to be able to investigate an unfamiliar system, determine what matters, and bring the right people with you. YOU WILL The work spans hands-on application security, security automation, vulnerability management, and infrastructure partnership. Depending on where you find the greatest risk and leverage, projects could include: - Build a recurring product security review program. Threat model new features, audit high-risk areas, review code, and build safe proof-of-concepts in isolated development environments. Work across our backend, frontend, APIs, and customer-facing integrations. - Improve application security testing. Combine static analysis, dependency and secrets scanning, dynamic testing in development, and carefully scoped production testing. Use existing tools where they fit and build focused automation where they don’t. - Own vulnerability intake and remediation. Triage findings from HackerOne, scanners, penetration tests, audits, customers, and internal research. Reproduce issues, assess exploitability and impact, track remediation, and verify fixes. Serve as technical lead for our bug bounty program while contract and budget ownership remain elsewhere. - Turn security alerts into useful engineering work. Verify scanner coverage and automate ingestion, deduplication, enrichment, prioritization, and routing—so teams spend less time interpreting alerts and more time fixing important issues. - Make dependency remediation safer and less manual. Improve scanning across our Python and TypeScript codebases, then build workflows to assess upgrades, stage pull requests, run checks, and route work without exposing credentials to untrusted packages or build steps. - Make secrets routinely rotatable. Partner with service owners and Infrastructure to inventory application secrets, add graceful rotation paths, document provider-specific runbooks, and automate rotation where the provider and risk justify it. Expand our use of Vault-backed dynamic credentials and reduce the number of rotations that require a coordinated fire drill. - Strengthen AWS security with Infrastructure. Evaluate and improve automated detection of risky configuration across identity, networking, compute, storage, containers, and registries. Turn findings into secure defaults, just-in-time access patterns, infrastructure guardrails, and actionable remediation—not build a second Infrastructure team. - Support audits and raising the security floor. Partner with Security & Trust on external assessments, provide technical context, and ensure findings are fixed rather than rediscovered. Along the way, create documentation, paved roads, and lightweight training that helps engineers make safer choices without waiting for a security review. - Take a key technical role in security incident response. Partner with Engineering and Infrastructure to coordinate investigation, containment, and remediation. Contribute to root-cause analysis and follow-up improvements, translating lessons learned into stronger controls and reduced recurrence. Tech you’ll touch: Python, TypeScript, React, Flask, FastAPI, GraphQL, Docker, Kubernetes, AWS, Vault, GitHub Actions, MongoDB, PostgreSQL, Redis, Kafka, Elasticsearch and the security tooling you help us choose. BENEFITS - Compensation: Competitive pay plus an organization-wide goal-based bonus - Paid Time Off: ~5 weeks of PTO to start. Plus a 1-week all-company Winter Holiday Break and paid US holidays. You'll earn 2 extra days for every year you're with Close. - 80% Work Option: Work with your manager to choose between a standard 5-day week or a 4-day week at 80% pay - Parental Leave: Paid leave for primary and secondary caregivers - Sabbatical: A 1-month paid sabbatical every 5 years with the team - Healthcare (US residents): Two medical plans with Close covering the majority of your premium, plus Dental, Vision, HSA, FSA, and company-paid Long-Term Disability - 401k (US residents): We match your contributions up to 6%, vested immediately OUR VALUES Build a house you want to live in - Examine long-term thinking and action No BS - Practice transparency and honesty, especially when it’s hard Invest in each other - Build successful relationships with your coworkers and customers Discipline equals freedom - Keep your word to yourself and others Strive for greatness - Constantly challenge yourself and others LEARN MORE Listen to our CEO and Founder, Steli Efti, tell the story of Close’s journey in the $0-30m Blueprint https://www.close.com/blueprint.  Watch our culture video https://www.youtube.com/watch?v=maXKi1GN2MI from our 2023 team retreat in Milan. Every year our entire team gathers in person to build connection, foster cross-functional collaboration, and have fun. In 2027, we're headed to Dusseldorf, Germany! Explore our product. Check out a demo https://www.close.com/demo-site! OUR HIRING PROCESS We ask a few role-specific questions as part of our application process. These questions are designed to help us learn more about you from the start, so please answer each one thoughtfully. We see this as an opportunity to get to know you beyond your resume. We use AI tools daily at Close and expect candidates to do the same. In evaluating your application, we aim to get a sense for you - the way you think, how you communicate, the work you've done. Applications that read as fully AI-generated will not be considered. Regardless of fit, you can expect to hear back from our team with an update on the status of your candidacy. If you progress to the interview process, you'll receive a full outline of the role-specific steps in your first touchpoint with us. We do our best to make the hiring process clear and human.

Location: Foster City, CA Workplace: Hybrid Replit is the agentic software creation platform that enables anyone to build applications using natural language. With millions of users worldwide, Replit is democratizing software development by removing traditional barriers to application creation. Join us at the forefront of AI and cloud-native security as we work to secure one of the most innovative developer platforms in the world. As the Cloud Security Lead, you will shape the cloud and infrastructure security program that protects millions of developers, enables safe AI-assisted development, and ensures organizations can confidently bring our platform into enterprise environments. In this role, you will own cloud security across GCP (primary) and supplemental environments in AWS and Azure, as well as containerized systems, SaaS platforms, and our multi-tenant AI infrastructure. You’ll improve our security posture through strong architecture, posture management, secure-by-default development practices, and close partnership with Engineering, Compliance, Security Architecture, and Platform teams. This is a highly impactful, hands-on leadership role—perfect for someone who wants to solve complex security challenges at scale while influencing product, engineering, and go-to-market teams. WHAT YOU’LL DO: CLOUD SECURITY ENGINEERING - Lead configuration hardening across GCP, with additional oversight of workloads and integrations running in AWS and Azure. - Own and optimize CSPM platforms across multi-cloud environments—establishing configuration baselines, guardrails, and remediation workflows. - Secure critical SaaS platforms, ensuring proper configurations, access controls, and engineering integrations. - Lead infrastructure vulnerability management across multi-cloud systems, containers, registries, and platform services. - Enhance security across containerized and Kubernetes (GKE/EKS/AKS) workloads, including runtime protections, network policies, and workload identity. - Assess secure logging configurations across cloud/SaaS providers, ensuring audit logs, retention, and routing meet monitoring and architecture needs. SECURE DEVELOPMENT & ARCHITECTURE ENABLEMENT - Partner with engineering teams to make services secure by default, embedding security into development workflows, CI/CD pipelines, and cloud-native deployments. CROSS-FUNCTIONAL RESPONSIBILITIES - Collaborate with Security Monitoring, Compliance/GRC, Architecture, DevOps, Platform Engineering, and ML Infrastructure. - Participate in communicating security advisories, best practices, and updates to Replit’s customers. - Support incident investigations as a cloud security subject-matter expert. REQUIRED SKILLS & EXPERIENCE: - 7+ years of experience in cloud engineering, with 3+ years in a senior or lead role. - Hands-on experience with CSPM tools (Wiz, Lacework, Prisma, Orca, SCC, etc.). - Deep expertise in GCP security (IAM, VPC, KMS, GKE, Cloud Logging). - Experience securing and governing SaaS platforms and identity integrations. - Operational experience with infrastructure vulnerability management across cloud and container environments. - Working knowledge of AWS and/or Azure security services and configurations. - Experience with container and Kubernetes security across GKE, EKS, or AKS. - Strong IaC security experience with Terraform, Pulumi, or similar tooling. - Familiarity with compliance standards (SOC 2, ISO 27001, PCI DSS). PREFERRED QUALIFICATIONS: - Experience supporting engineering teams in building secure-first, cloud-native or PaaS environments. - Background securing AI/ML pipelines, model-serving infrastructure, or developer platform services. - Experience in high-growth technology or cloud-native product companies. - Experience with securing AI/agentic systems and sensitive data pipelines. - Automation/scripting with Python. - Relevant certifications (e.g., GCP Professional Cloud Security Engineer, AWS/Azure security certs). WHAT WE VALUE: - Problem-solving mindset — Ability to break down complex security and operational challenges into clear engineering solutions. - Autonomy — Comfortable leading initiatives, collaborating effectively, and driving outcomes with minimal oversight. - Communication excellence — Able to translate deep technical concepts for engineers, executives, and enterprise customers. - Continuous learning — Passion for staying current with AI security, cloud-native advances, and emerging threats. - Automation-first approach — Belief in reducing operational toil and building scalable, self-healing systems. This is a full-time role that can be held from our Foster City, CA office. The role has an in-office requirement of Monday, Wednesday, and Friday. Full-Time Employee Benefits Include: 💰 Competitive Salary & Equity 💹 401(k) Program with a 4% match (US Only) ⚕️ Health, Dental, Vision and Life Insurance 🩼 Short Term and Long Term Disability 🚼 Paid Parental, Medical, Caregiver Leave 🏝 Flexible Time Off (FTO) + Holidays 🚗 Commuter Benefits (In-Office & US Only) 📱 Monthly Wellness Stipend 🧑‍💻 Autonomous Work Environment 🖥 In Office Set-Up Reimbursement (In-Office Only) 🚀 Quarterly Team Gatherings ☕ In Office Amenities (In-Office Only) Want to learn more about what we are up to? - Self-driving Company https://replit.com/blog/self-driving-company - Replit Agent at Scale https://replit.com/blog/evaluating-and-improving-agent-at-scale - AI Adoption https://replit.com/blog/ai-adoption - Build Open-Source Apps https://replit.com/build/open-source-app-builder   Interviewing + Culture at Replit - Operating Principles https://blog.replit.com/operating-principles - Reasons not to work at Replit https://blog.replit.com/reasons-not-to-join-replit To achieve our mission of making programming more accessible around the world, we need our team to be representative of the world. We welcome your unique perspective and experiences in shaping this product. We encourage people from all kinds of backgrounds to apply, including and especially candidates from underrepresented and non-traditional backgrounds.

• Проектировать и развивать identity-сервисы (SSO, MFA, управление сессиями, федерация). • Писать чистый, конкурентный и высокопроизводительный код на Go.

Зарплата не указана

Задачи: — Разработка и внедрение правил обнаружения угроз (создание, тестирование, оптимизация) — Подключение и интеграция новых источников данных (организация подключения, настройка парсеров, фильтров и нормализации данных) — Формирование гипотез для Threat Hunting (анализ данных, формирование гипотез/intake идей) — Документирование и сопровождение (каталог контента: правила по детектированию угроз, подключенные источник, парсеры) — Мониторинг и оптимизация правил детектирования (анализ FP, снижение уровня "шума", аудит и актуализация существующего контента, управление исключениями) Требования: — Опыт работы в сфере информационной безопасности (желательно в SOC) — Понимание принципов работы SIEM‑систем (ELK, MP, KUMA и пр,) — Опыт написания и отладки правил обнаружения — Знание MITRE ATT&CK Framework и умение применять его на практике — Опыт работы с логами различных систем: ОС (Windows, Linux), сети (Firewall, Proxy, DNS), EDR, приложения — Навыки парсинга и нормализации логов (регулярные выражения, grok‑паттерны, JSON/XML парсинг)

Зарплата не указана

Location: Foster City, CA Workplace: Hybrid Replit is the agentic software creation platform that enables anyone to build applications using natural language. With millions of users worldwide, Replit is democratizing software development by removing traditional barriers to application creation. ABOUT THE ROLE We're looking for a Security Engineer with deep incident response experience to help defend Replit, a fast-moving, cloud-native AI vibe-coding platform. You'll be the person who takes charge when something goes wrong. You'll lead investigations from first signal to root cause, coordinate containment across Security, SRE, and Engineering, and keep stakeholders informed while the incident is moving fast. This isn't a pure responder role. We want a well-rounded security engineer who has run real incidents and wants to make the next one faster. You'll write the scripts, automations, and tooling that take manual work out of triage, evidence collection, and containment. You'll also turn lessons from each incident into better detections, playbooks, and platform hardening.   RESPONSIBILITIES Incident Response - Serve as incident commander or technical lead for security incidents, from detection and triage through containment, eradication, recovery, and post-incident review. - Coordinate response across Security, SRE, Engineering, Legal, and leadership. Drive decisions under pressure and keep a clear record of actions taken. - Communicate incident status, impact, and risk clearly to technical and executive audiences. - Participate in and help shape the security on-call rotation. Investigation & Forensics - Investigate suspicious activity across cloud infrastructure, containers, identity systems, and application layers using SIEM, Cloud Logging, telemetry, and host and container artifacts. - Determine scope, root cause, attacker behavior, and blast radius for confirmed incidents. - Quickly assess whether emerging threats (0-days, active exploitation campaigns, bug bounty findings, customer reports) apply to Replit, and whether we're already affected. IR Automation & Tooling - Build scripts, automations, and tools (Python, Go, Bash, or directly on Replit) that speed up response, such as automated enrichment, evidence collection, credential and session revocation, workload isolation, and alert triage. - Develop and maintain response playbooks and runbooks, and automate them where possible. - Integrate response workflows with SIEM, SOAR, ticketing, and chat tooling to cut time-to-contain. Detection & Continuous Improvement - Turn incident findings into new or improved detections, logging coverage, and visibility. - Lead blameless post-incident reviews and drive remediation items to completion. - Run tabletop exercises and simulations to test readiness and find gaps.   REQUIRED SKILLS & EXPERIENCE - Proven experience leading or serving as technical lead on security incidents in a cloud or SaaS environment. - Strong hands-on investigation skills with SIEM, cloud audit logs, and log-based analysis. Comfortable working through large datasets under time pressure. - Proficiency writing production-quality scripts or tools in Python, Go, or Bash for investigation and automation. - Solid knowledge of cloud architecture and security, especially Google Cloud Platform (IAM, audit logging, GKE, networking). - Working knowledge of Kubernetes and containers, including how to investigate and contain compromised workloads. - Understanding of identity systems, SaaS architectures, and common cloud attack paths (credential theft, privilege escalation, supply chain, token abuse). - Familiarity with software engineering fundamentals, CI/CD pipelines, and package ecosystems, so you can work effectively with Engineering on code-level fixes. - Understanding of IR frameworks and lifecycle (for example NIST 800-61), plus the vulnerability lifecycle and exploitability analysis.   PREFERRED QUALIFICATIONS - Experience building or operating SOAR or other response automation platforms. - Digital forensics experience with cloud, Linux hosts, or containers. - Experience with threat intelligence, threat hunting, or security research. - Experience with bug bounty programs or coordinated vulnerability disclosure. - Familiarity with detection-as-code practices and writing detection rules. - Experience in fast-paced, cloud-native, or AI/ML-driven environments. - Relevant certifications (such as GCIH, GCFA, GCFR), or equivalent hands-on experience. WHAT WE VALUE - Curiosity & initiative: Strong desire to understand attacker behaviors, emerging threats, and how they apply to real-world systems. - Speed & analytical rigor: Ability to quickly assess high-risk vulnerabilities with clear, evidence-based reasoning. - Collaboration: Comfort working across cross-functional teams spanning Security, SRE, Engineering, and Infrastructure. - Clear communication: Ability to explain findings, risks, and mitigation strategies to stakeholders at all levels. - Ownership mindset: Takes initiative to drive investigations, improvements, and remediations to completion. - Continuous learning: Passion for staying up to date on new vulnerabilities, exploit trends, and cloud-native security best practices. Full-Time Employee Benefits Include: 💰 Competitive Salary & Equity 💹 401(k) Program with a 4% match (US Only) ⚕️ Health, Dental, Vision and Life Insurance 🩼 Short Term and Long Term Disability 🚼 Paid Parental, Medical, Caregiver Leave 🏝 Flexible Time Off (FTO) + Holidays 🚗 Commuter Benefits (In-Office & US Only) 📱 Monthly Wellness Stipend 🧑‍💻 Autonomous Work Environment 🖥 In Office Set-Up Reimbursement (In-Office Only) 🚀 Quarterly Team Gatherings ☕ In Office Amenities (In-Office Only) Want to learn more about what we are up to? - Self-driving Company https://replit.com/blog/self-driving-company - Replit Agent at Scale https://replit.com/blog/evaluating-and-improving-agent-at-scale - AI Adoption https://replit.com/blog/ai-adoption - Build Open-Source Apps https://replit.com/build/open-source-app-builder   Interviewing + Culture at Replit - Operating Principles https://blog.replit.com/operating-principles - Reasons not to work at Replit https://blog.replit.com/reasons-not-to-join-replit To achieve our mission of making programming more accessible around the world, we need our team to be representative of the world. We welcome your unique perspective and experiences in shaping this product. We encourage people from all kinds of backgrounds to apply, including and especially candidates from underrepresented and non-traditional backgrounds.

• Проведение пентестов web-приложений и API (black-box, grey-box, white-box), включая REST, GraphQL, gRPC и WebSocket. • Тестирование безопасности AI/LLM-функциональности (Prompt Injection, Data Leakage, RAG, MCP, Agentic AI и другие сценарии по OWASP Top 10 for LLM).

Зарплата не указана

Location: Remote (United States | Canada) Workplace: Remote 1Password is growing. We’ve surpassed $400M in ARR and we’re continuing to accelerate, earning a spot on the Forbes Cloud 100 for four years in a row and teaming up with iconic partners like Oracle Red Bull Racing. About 1Password At 1Password, we’re building the foundation for a safe, productive digital future. Our mission is to unleash employee productivity without compromising security by ensuring every identity is authentic, every application sign-in is secure, and every device is trusted. We innovated the market-leading enterprise password manager and pioneered Unified Access Management, a new cybersecurity category built for the way people and AI agents work today. As one of the most loved brands in cybersecurity, we take a human-centric approach in everything from product strategy to user experience. Over 180,000 businesses, from Fortune 100 leaders to the world’s most innovative AI companies, trust 1Password to help their teams securely adopt the SaaS and AI tools they need to do their best work. If you're excited about the opportunity to contribute to the digital safety of millions, to work alongside a team of curious, driven individuals, and to solve hard problems in a fast-paced, dynamic environment, then we want to hear from you. Come join us and help shape a safer, simpler digital future. Security isn't a feature at 1Password. It is the product. We're looking for a Principal Product Manager to shape security strategy across the company, working with Security Engineering, who hold one of the highest technical bars in the industry, and with the product teams building everything our customers touch. You'll be the bridge. You'll understand cryptographic and architectural detail well enough to earn the trust of our security engineers, and you'll translate what matters into clear priorities for feature teams. Just as importantly, you'll bring a deep respect for the customer: a security control nobody can stand to use makes everyone less safe. You'll help us find the design that's both rigorous and usable, and have the credibility to say so in a room full of experts WHAT YOU'LL DO - Partner with product teams on security early. Work with PMs and feature teams to understand their upcoming roadmaps, identify security requirements and threat-model implications before designs are locked, and make sure those needs are visible, prioritized, and resourced. - Align Security Engineering with product strategy. Translate feature-team needs into prioritized security work, and make Security Engineering's priorities legible to the rest of the company so tradeoffs are made in the open. - Own an independent security roadmap. Set direction for platform-level security investments, such as key management and recovery, the cryptographic foundations of our zero-knowledge architecture, authentication, and our long-term readiness for post-quantum cryptography. - Lead our strategy for the AI era. Define how 1Password approaches agentic access to credentials, secrets for non-human identities and AI agents, and the trust models emerging around tools and protocols like MCP. - Balance risk and usability with evidence. Help security engineers weigh real-world risk against user friction, using adoption, support, and telemetry data alongside threat models. Shipping with accepted, documented residual risk is sometimes the right call, and you'll help us make and defend those decisions. - Represent 1Password to the security community. Engage with security researchers and our bug bounty program, speak at conferences, and contribute to the wider conversation about where credential security is heading. - Raise the bar for product work. Coach PMs on security thinking, challenge assumptions constructively, and set the standard for how security-critical product work gets done. OUR PHILOSOPHY ON PRODUCT CONSISTS OF FIVE CORE PILLARS: - Focus and execution: Can you ship quickly and measure results? - Customer empathy: Are you motivated first and foremost to solve customer problems? - Effective communication: Can you bring the entire organization, horizontally and vertically, along on the journey? - Go to market: Can you understand and drive business outcomes through product decisions? - Technology: Articulating how our technology beats our competitors Product Managers play a highly visible role at 1Password and are critical to the development and execution of our product strategy. As PMs, we are responsible for setting and championing a high bar for our products. At the Principal level, you also set the standard for how product work gets done. You coach, you challenge assumptions, and you make the whole team better. You must excel at prioritization, collaboration, and communication, while holding yourself and others accountable for measuring quality and business results. You will work with Engineering, Design, Security Research, and GTM teams to ensure every decision we make as a product is grounded in our commitment to verifiable security. WHAT WE'RE LOOKING FOR - 10+ years of product management experience, including significant time on security-critical products or platforms in a SaaS environment. We'll also strongly consider exceptional candidates with equivalent depth, such as security engineers or researchers who moved into product. - Deep, demonstrable knowledge of security fundamentals: cryptography, authentication protocols, identity and access management, zero-knowledge and end-to-end encrypted system design, and threat modeling. - Fluency in the credential and identity landscape, including passkeys, WebAuthn/FIDO, and the standards shaping how people sign in. - A track record of earning credibility with security engineering teams, not just working alongside them. - The ability to read and reason through technical specifications, security audits, and cryptographic design documents. - Experience making and defending risk-based tradeoffs, and explaining them clearly to engineers, executives, and customers. - A history of shipping security features that users actually adopt, and of using friction and adoption data to improve them. - Experience setting strategy at the platform or infrastructure level, and influencing roadmaps you don't own without formal authority. - Communication that scales from a security research paper to an executive briefing without losing precision in either direction. - A strong point of view on how the security landscape is shifting, and the ability to connect it to concrete roadmap decisions. STRONG PLUS - Standing in the security community, through conference talks, publications, research, open-source work, or standards participation. - Hands-on experience with AI security: agent identity and authorization, prompt injection, secrets management for automated systems. - Experience with compliance and certification regimes such as SOC 2, FedRAMP, or FIPS. - Prior work in vulnerability disclosure, incident response, or threat intelligence that gives you a practitioner's intuition. - Experience running or working closely with a bug bounty program or researcher community. WHAT YOU CAN EXPECT - Working with a passionate, highly motivated Product and Security team that holds an exceptional bar and genuinely cares about getting it right - A direct line to decisions that shape the security architecture millions of people depend on every day - Empowerment to set long-term security product strategy and drive it through execution - A culture where technical depth is respected, tradeoffs are named honestly, and shipping the right thing matters more than shipping fast - A collaborative environment where the best argument wins, regardless of title USA-based roles only: The annual base salary for this role is between $238,000 USD and $357,000 USD; 15% annual bonus, plus immediate participation in 1Password's benefits program (health, dental, 401k and many others), utilization of our generous paid time off, an equity grant and, where applicable, participation in our incentive programs. Canada-based roles only: The annual base salary for this role is between $208,000 CAD and $312,000 CAD; 15% annual bonus, plus immediate participation in 1Password’s generous benefits program (health, dental, RRSP and many others), utilization of our generous paid time off, an equity grant and, where applicable, participation in our incentive programs. At 1Password, we approach each individual's compensation with a promise of fair market value and internal equity commensurate with experience and specific skill set. This posting is for an existing vacancy. Our culture At 1Password, we prioritize collaboration, clear and transparent communication, receptiveness to feedback, and alignment with our core values: keep it simple, lead with honesty, and put people first. You’ll be part of a team that challenges the status quo, and is excited to experiment and iterate in search of the best solution. That said, 1Password is not for everyone https://blog.1password.com/inside-the-culture-powering-1passwords-next-chapter/. Our work is demanding, we strive for excellence, and the pace is fast. We need people who are keen to take on challenging problems, who seek feedback to grow, and who are driven to make an impact. If you're looking for a place where you can settle into a comfortable routine, this might not be the right fit for you. We’re looking for individuals who are proven experts in their fields, as well as those who are highly adaptable, can thrive in ambiguity and through change, are curious, and above all deliver results. How we work with AI We are committed to leveraging cutting-edge technology—including AI—to achieve our mission. We also understand that thinking critically about AI in its current forms will help us create better solutions for our customers and ourselves with its future forms, which will help us continue to close the gap between security and privacy and achieve our mission. We want team members at all levels to take the approach of actively learning AI best practices, identifying opportunities to apply AI in meaningful ways, and driving innovative solutions in their daily work. Embracing the future of AI isn't just encouraged—it's an essential part of how we will be successful at 1Password. This approach extends to our hiring process—candidates are welcome to use AI tools responsibly and thoughtfully during the application process. To us, this means we do ask that you join live interviews without using AI tools so we can get to know how you communicate, solve problems, and collaborate with others. Our approach to remote work We believe in the power of remote work, but recognize that in-person connection is important to help us achieve our mission. While we are a remote-first company, travel for in-person engagement is a part of almost all roles, and we require our employees to be ready and willing to take part. Frequency will depend on role and responsibilities, and may include, but is not limited to: annual department-wide offsites, team meetings, and customer/industry events. What we offer We believe in working hard, and rewarding that hard work through our benefits. While not an exhaustive list, here is a glance at what we currently offer: Health and wellbeing 👶 Maternity and parental leave top-up programs 🩺 Competitive health benefits 🏝 Generous PTO policy Growth and future 📈 RSU program for most employees 💸 Retirement matching program 🔑 Free 1Password account Community 🤝 Paid volunteer days 🏆 Peer-to-peer recognition through Bonusly 🌎 Remote-first work environment *Some roles in our GTM team are currently being hired for in-person hybrid work in Toronto and Austin. These roles will specify on the posting. You belong here. 1Password is proud to be an equal opportunity employer. We are committed to fostering an inclusive, diverse and equitable workplace that is built on trust, support and respect. We welcome all individuals and do not discriminate on the basis of gender identity and expression, race, ethnicity, disability, sexual orientation, colour, religion, creed, gender, national origin, age, marital status, pregnancy, sex, citizenship, education, languages spoken or veteran status. Be yourself, find your people and share the things you love. Accommodation is available upon request at any point during our recruitment process. If you require an accommodation, please speak to your talent acquisition partner or email us at nextbit@agilebits.com and we’ll work to meet your needs. Remote work is a part of our DNA. Given that our company was founded remotely in 2005, we can safely say we're experts at building remote culture. That said, remote work at 1Password does mean working from your home country. If you've got questions or concerns about this, your talent partner would be happy to address them with you. Successful applicants will be required to complete a background check that may consist of prior employment verification, reference checks, education confirmation, criminal background, publicly available social media, credit history, or other information, as permitted by local law. 1Password uses artificial intelligence (AI) and machine learning (ML) technologies, including natural language processing and predictive analytics, to assist in the initial screening of employment applications and improve our recruitment process. See here https://www.ashbyhq.com/downloadables/ashby-bias-audit-08-2024.pdf for the latest third party bias audit information. If you prefer not to have your application assessed using AI/ML features, you may opt out by completing this form https://jobs.ashbyhq.com/1password/automation-notice. For additional information see our Candidate Privacy Notice https://1password.com/files/candidate-privacy-notice.pdf.

Location: Seattle, WA Workplace: Remote ABOUT DOCKER Docker has been one of the most loved brands in developer tooling, trusted by more than 20 million monthly users and over 20 billion container image pulls. From solo founders to the world's largest companies, developers rely on Docker to build, share, and run their applications across our suite of products including Docker Desktop, Docker Hub, and Docker Scout. We are a globally distributed, remote-first team building the tools that define how software gets built and delivered. As AI agents redefine software development, Docker is at the center of that shift, providing the sandboxed environments, verified images, and secure infrastructure that make autonomous workflows trustworthy by default. _______________________________________________________________________ We're building AI-native development practices into how this team works at a foundational level. That means infrastructure design needs to account for a new kind of collaborator: AI agents that generate, deploy, and operate software. The Staff Infrastructure Engineer on this team will keep systems running, define what safe, observable, AI-assisted infrastructure operations look like in practice, and set the standard for how the broader engineering organization follows. WHAT YOU'LL WORK ON The Billing Platform Engineering team owns the systems that make Docker's commercial model real. You'll work on problems like: - How do we design infrastructure that makes AI-generated deployments safe to ship and easy to roll back? - How do we instrument billing systems so that failures — billing miscalculations, entitlement gaps, payment errors — are detected immediately and unambiguously? - How do we build infrastructure that scales with usage-based billing workloads without manual intervention? - How do we make the developer experience on this team faster and more reliable — local environments, CI/CD pipelines, deployment tooling? RESPONSIBILITIES - Own and evolve the infrastructure supporting Billing Platform services: compute, storage, networking, CI/CD, and observability - Design and maintain IaC (Terraform) for billing system infrastructure on AWS; set module patterns and standards for the team - Build and own observability systems — metrics, logging, alerting — with a focus on billing accuracy and payment reliability - Define deployment patterns and runbooks that work well in an AI-agent-assisted development workflow: clear rollback procedures, safe promotion gates, automated validation - Partner with software engineers on service design — bringing infrastructure constraints and operational requirements into the conversation before code is written - Identify systemic risks and drive improvements that span team or organizational boundaries - Lead incident response for billing system issues. This role may require participation in an on-call rotation to provide support outside of standard business hours, including evenings, weekends, and holidays, as needed. - Mentor engineers across the team; your technical judgment should raise the floor for everyone QUALIFICATIONS - 8+ years in platform, infrastructure, or SRE roles supporting production SaaS systems at scale - Deep AWS expertise: ECS or EKS, RDS (Postgres preferred), networking, IAM, cost management — you've operated these systems under real load and real incidents - Expert-level Terraform; you've designed reusable module patterns and set standards others follow - Experience building and owning observability stacks (Datadog, Grafana, or similar) at an organizational level — not just using them - Strong familiarity with CI/CD systems — Jenkins, GitHub Actions, or equivalent — including pipeline design and developer experience ownership - Kubernetes at an operational and architectural level - A track record of identifying systemic risks and driving improvements that span team or organizational boundaries - Security-first mindset: threat modeling, blast radius analysis, least-privilege by default, audit trails as a design requirement - Strong written English; at Staff level, written communication is how you scale your influence across teams - Bachelor’s degree in Computer Science, Engineering, or a related field, or equivalent practical experience WHAT SETS YOU APART You don't wait for problems to be handed to you — you find them, frame them, and drive the solution. You've operated at a scope where your decisions affected multiple teams or systems, and you know how to build consensus and move work forward without direct authority. You've thought seriously about what infrastructure needs to look like when AI agents are generating and shipping code — safe deployment patterns, strong observability, clean rollback — and you want to help define that standard here. Experience with billing, payments, or financial systems infrastructure is a meaningful plus. WHAT TO EXPECT FIRST 30 DAYS You will ship code in your first week. We run an agent-first development workflow — infrastructure changes start with a plan, specifications are written before generation, and every change is reviewed before it merges — and onboarding is no exception. You will get hands-on with the infrastructure supporting Billing Platform services early, shadow on-call, and build a clear picture of the system before you start making bigger changes. By the end of 30 days you will have shipped real work and know where the most important problems are. FIRST 90 DAYS You will have taken ownership of one or more infrastructure components and delivered an improvement from design to production with measurable impact. You will be an active participant in deployment and reliability discussions, bringing infrastructure constraints and operational requirements into the conversation early — before code is written. You will be a full participant in the on-call rotation and have begun shaping the team's technical direction. ONE YEAR OUTLOOK You will be the team's trusted authority on billing infrastructure. You will have driven meaningful improvements to observability, deployment safety, or platform reliability — and your work will be directly visible in the resilience and correctness of systems that handle real financial transactions for millions of Docker users. You will have helped define what AI-agent-assisted infrastructure operations look like done right, and that standard will be visible beyond this team. Docker considers sponsorship on a case-by-case basis based on business needs.   Compensation & Equity United States: $170,350 – $275,550 + equity ______________________________________________________________________ POSTING INFORMATION - Open vacancy: This posting is for an existing open role. - AI in hiring: Docker may use AI-assisted tools during our recruiting process. - Interview recordings: Candidates will be invited to opt in to interview recordings to support interviewer calibration and consistent evaluations. Recordings are optional and require explicit consent. ______________________________________________________________________ PERKS & BENEFITS - Remote-first by design – Work from your home, with offices in Seattle and Paris for connection and collaboration. - Flexibility that fits your life – We trust you to manage your schedule while delivering great work. - Time to recharge – Generous PTO, designated quarterly Whaleness Days, and a designated end-of-year Whaleness break. - Home office support – Set up your workspace for comfort and success. - Technology stipend – Equivalent to US$100 net per month to help support your work. - Learning & development – Annual stipend for conferences, courses, certifications, and continued learning. - Parental leave – 16 weeks of paid parental leave after six months of employment. - Equity for all full-time employees – Share in Docker's long-term success as we continue to grow. - Comprehensive benefits – Medical, retirement, and paid holidays vary by country. - Docker swag – Because representing the whale never gets old. Docker is proud to be an equal opportunity employer. We are committed to building a team that reflects a broad range of backgrounds, experiences, and perspectives. We believe diverse teams build better products, make better decisions, and better serve our global community. #LI-REMOTE

Location: United States; Canada Workplace: Remote ABOUT DOCKER Docker has been one of the most loved brands in developer tooling, trusted by more than 20 million monthly users and over 20 billion container image pulls. From solo founders to the world's largest companies, developers rely on Docker to build, share, and run their applications across our suite of products including Docker Desktop, Docker Hub, and Docker Scout. We are a globally distributed, remote-first team building the tools that define how software gets built and delivered. As AI agents redefine software development, Docker is at the center of that shift, providing the sandboxed environments, verified images, and secure infrastructure that make autonomous workflows trustworthy by default. _______________________________________________________________________ As a Senior Security Engineer, Offensive Security, you'll help drive offensive security at Docker, putting our products, platforms, and cloud infrastructure under realistic adversarial testing to surface and drive out attack paths before real adversaries find them. You'll partner with engineering, product, and leadership to turn findings into durable fixes and to shape how security is designed into every Docker product. You'll apply your expertise in penetration testing, threat modeling, and exploit development to find and eliminate risks across Docker products and infrastructure. Working across cloud infrastructure (AWS, GCP, Azure), containerized environments, and AI/ML products, you'll implement proactive security solutions that scale with Docker's growth. This role offers the opportunity to help improve security programs at a company whose products are trusted by millions of developers worldwide. You'll work in a fast-paced, technically challenging environment where your security expertise directly impacts both Docker's platform and the broader container ecosystem. RESPONSIBILITIES: - Contribute to security initiatives that align with business goals, helping ensure security is a core component of our products and infrastructure - Support and help implement key security programs such as automated security design reviews, and vulnerability management - Build deep knowledge of software security and architecture, and act as a go-to resource for engineering teams - Partner with engineering to design and implement security architecture and controls across Docker products and platforms - Plan, scope, and execute penetration tests and red-team / adversary-emulation engagements against Docker's products and services - Develop proof-of-concept exploits and produce clear, risk-rated findings with actionable remediation guidance, then retest fixes to confirm closure - Build and maintain offensive security tooling and automation to expand testing coverage and repeatability - Perform security reviews and threat modeling (design, architecture, and code) across Docker products and services, including emerging AI products, and write automated security tests and exploits - Serve on rotating on-call schedule to respond to security events, investigate threats, and coordinate remediation efforts - Educate and collaborate with cross-functional teams (e.g., engineering, product) to promote security practices - Participate in Security Incident response QUALIFICATIONS - Have 3+ years in security engineering, including hands-on offensive security and penetration testing across applications and infrastructure - Possess 2+ years of hands-on development experience in Python or Golang - Demonstrate deep expertise in authentication, authorization, including technologies like OAuth, cryptography applications and Zero Trust principles. - Have strong hands-on experience with securing cloud ecosystems (e.g. AWS, GCP, Azure) - Have hands-on penetration testing experience across SaaS web applications and APIs., including manual exploitation beyond automated scanners - Are proficient with offensive tooling and techniques such as. Burp Suite, and OWASP frameworks - Can write security tests and develop exploits and proof-of-concepts that find real vulnerabilities in a product - Understand AI/ML security risks and mitigations, including prompt injection, data poisoning, model extraction, and adversarial attacks - Have practical experience using LLMs and agentic tooling to automate vulnerability discovery, reconnaissance, and pentesting workflows - Have a track record of building security programs and automations from scratch, applying risk-based prioritization - Have experience performing security reviews and building or improving security review automation - Have excellent communication skills, allowing you to explain complex security concepts clearly to technical and non-technical stakeholders - Understand industry standards, and actively keep up with emerging security technologies and models - Are a team player who drives security change via collaboration and cross-functional partnerships - Hold offensive security certifications such as OSCP, OSWE, OSEP, GXPN, GPEN, or CRTO - Have published CVEs, original security research, or conference talks Bonus if you: - Have experience with container escape, Kubernetes attack paths, or cloud red teaming - Have experience testing AI/ML systems for issues like prompt injection, model extraction, and data poisoning WHAT TO EXPECT FIRST 30 DAYS: - Meet with security team and key partners across engineering - Gain access to team owned systems, and internal documentation - Complete security awareness training and compliance onboarding - Review application architecture, tech stack and data flow - Review risk registry and annual roadmap - Familiarize oneself with team workflows and processes - Shadow a fellow security engineer during their on-call/secops rotations FIRST 90 DAYS: - Conduct security review on emerging Docker products - Scope and execute your first penetration test against a Docker product or service - Actively participate in architecture design reviews with the team - Contribute to a Security-owned project or initiative - Collaborate with Docker developers to validate and resolve discovered vulnerabilities - Enhance incident response capabilities by participating in on-call rotation and post-incident activities - Create and maintain security documentation and runbooks FIRST YEAR OUTLOOK - Contribute to the security roadmap for improving security controls - Strengthen Zero Trust architecture and least privilege access controls - Enhance security monitoring and anomaly detection - Perform security reviews for major product releases - Own and run recurring penetration tests and adversary-emulation exercises across Docker products, and engage with external researchers - Support audits and ensure compliance with SOC 2, ISO 27xxx - Advocate for “security by design” in all product features - Become well versed in Docker products and emerging AI technologies Docker does not offer visa sponsorship for this role.   Compensation & Equity Canada: CA$271,150 – CA$434,000 + equity United States: $194,150 – $312,950 + equity ______________________________________________________________________ POSTING INFORMATION - Open vacancy: This posting is for an existing open role. - AI in hiring: Docker may use AI-assisted tools during our recruiting process. - Interview recordings: Candidates will be invited to opt in to interview recordings to support interviewer calibration and consistent evaluations. Recordings are optional and require explicit consent. ______________________________________________________________________ PERKS & BENEFITS - Remote-first by design – Work from your home, with offices in Seattle and Paris for connection and collaboration. - Flexibility that fits your life – We trust you to manage your schedule while delivering great work. - Time to recharge – Generous PTO, designated quarterly Whaleness Days, and a designated end-of-year Whaleness break. - Home office support – Set up your workspace for comfort and success. - Technology stipend – Equivalent to US$100 net per month to help support your work. - Learning & development – Annual stipend for conferences, courses, certifications, and continued learning. - Parental leave – 16 weeks of paid parental leave after six months of employment. - Equity for all full-time employees – Share in Docker's long-term success as we continue to grow. - Comprehensive benefits – Medical, retirement, and paid holidays vary by country. - Docker swag – Because representing the whale never gets old. Docker is proud to be an equal opportunity employer. We are committed to building a team that reflects a broad range of backgrounds, experiences, and perspectives. We believe diverse teams build better products, make better decisions, and better serve our global community. #LI-REMOTE

• Формирование 12-месячного security roadmap; • Access & Device Security: IAM / RBAC, MFA / 2FA, VDI / Remote Desktop, MDM, шифрование;

до 5 000 $