Senior Software Engineer, Supply Chain Security
At Docker, we make app development easier so developers can focus on what matters. Our remote-first team spans the globe, united by a passion for innovation and great developer experiences. With over 20 million monthly users and 20 billion image pulls, Docker is the #1 tool for building, sharing, and running apps—trusted by startups and Fortune 100s alike. We’re growing fast and just getting started. Come join us for a whale of a ride!
The Supply Chain Security group is remaking software development and operations security through a holistic, developer-first approach to securing software and software artifacts. We are developing an end-to-end solution for securing the container ecosystem, starting in the developer inner loop and continuing through to production, emphasizing ease-of-use and automation every step of the way. This role will initially be focused on Docker Hardened Images, securing container images, maintaining the system that builds them, working day-to-day with open-source software, Linux distribution packages, BuildKit, GitHub Actions, Docker Scout, and CVEs. Beyond building images, there will be extensive interaction with customers using Docker Hardened Images and helping to shape the tooling that makes these images as easy to work with as Docker Official Images.
If you are comfortable in a fast-paced, customer-first environment allowing you to dig into low-level details about how software is built, packaged, and run, this role is for you. Come contribute to creating an amazing developer experience around secure containers with the world’s experts in container images and supply chain security!
Responsibilities:
Creating and supporting secure container images and related metadata like SBOMs and vulnerabilities
Maintaining and enhancing SLSA Build Level 3 compliant build system leveraging BuiltKit and GitHub Actions
Collectively own the security posture and developer experience of using secure container images
Qualifications:
Experience building container images with BuildKit
Proficiency in modern programming languages (we primarily use Go), but experience with a diverse range of languages is also an asset (Javascript, Java, PHP, Python)
Understanding of low-level container image primitives, i.e., manifests, indices, digests, attestations, etc.
Familiarity with Linux distributions and compiling software from source
Experience with continuous integration systems, particularly GitHub Actions
Knowledge of software security tooling like Docker Scout
What to expect
First 30 days:
Integrate into a dynamic team building security-first container images for customers
Deepen knowledge of container images, container image builds, BuildKit, and vulnerabilities
Create your first few images with the help of your team
First 90 days:
Continue to create, maintain, and support secure images
Improve the image build system
Deepen your knowledge of images and building images
Help other new team members onboard
Regularly interact with customers using the images
Contribute to custom CVE feed and remediate vulnerabilities across the image catalog
Work with the team to develop custom-trained generative AI systems for image creation and maintenance
Begin to enhance image build and deployment user experience
One-Year Outlook:
Contribute to increased automation and efficiency of the secure image factory
Continue to help grow the team, interact with customers, and develop more efficient ways to create and maintain secure images using generative AI
Embrace data-driven tracking and reporting of how the images you are helping to build increase developer productivity while reducing vulnerability exposure
Grow in your skills beyond image creation and maintenance into developer tooling and backend services supporting developer needs
In collaboration with your manager, you will have a Career Development Plan that will outline your trajectory beyond your first year.
Docker considers sponsorship on a case-by-case basis based on business needs.
We use Covey as part of our hiring and / or promotional process for jobs in NYC and certain features may qualify it as an AEDT. As part of the evaluation process we provide Covey with job requirements and candidate submitted applications. We began using Covey Scout for Inbound on April 13, 2024.
Please see the independent bias audit report covering our use of Covey here.
Perks
Freedom & flexibility; fit your work around your life
Designated quarterly Whaleness Days plus end of year Whaleness break
Home office setup; we want you comfortable while you work
16 weeks of paid Parental leave
Technology stipend equivalent to $100 net/month
PTO plan that encourages you to take time to do the things you enjoy
Training stipend for conferences, courses and classes
Equity; we are a growing start-up and want all employees to have a share in the success of the company
Docker Swag
Medical benefits, retirement and holidays vary by country
Remote-first culture, with offices in Seattle and Paris
Docker embraces diversity and equal opportunity. We are committed to building a team that represents a variety of backgrounds, perspectives, and skills. The more inclusive we are, the better our company will be.
#LI-REMOTE