• Contribute to security initiatives that align with business goals, helping ensure security is a core component of our products and infrastructure
• Support and help implement key security programs such as automated security design reviews, and vulnerability management
• Build deep knowledge of software security and architecture, and act as a go-to resource for engineering teams
• Partner with engineering to design and implement security architecture and controls across Docker products and platforms
• Plan, scope, and execute penetration tests and red-team / adversary-emulation engagements against Docker's products and services
• Develop proof-of-concept exploits and produce clear, risk-rated findings with actionable remediation guidance, then retest fixes to confirm closure
• Build and maintain offensive security tooling and automation to expand testing coverage and repeatability
• Perform security reviews and threat modeling (design, architecture, and code) across Docker products and services, including emerging AI products, and write automated security tests and exploits
• Serve on rotating on-call schedule to respond to security events, investigate threats, and coordinate remediation efforts
• Educate and collaborate with cross-functional teams (e.g., engineering, product) to promote security practices
• Participate in Security Incident response

• Have 3+ years in security engineering, including hands-on offensive security and penetration testing across applications and infrastructure
• Possess 2+ years of hands-on development experience in Python or Golang
• Demonstrate deep expertise in authentication, authorization, including technologies like OAuth, cryptography applications and Zero Trust principles.
• Have strong hands-on experience with securing cloud ecosystems (e.g. AWS, GCP, Azure)
• Have hands-on penetration testing experience across SaaS web applications and APIs., including manual exploitation beyond automated scanners
• Are proficient with offensive tooling and techniques such as. Burp Suite, and OWASP frameworks
• Can write security tests and develop exploits and proof-of-concepts that find real vulnerabilities in a product
• Understand AI/ML security risks and mitigations, including prompt injection, data poisoning, model extraction, and adversarial attacks
• Have practical experience using LLMs and agentic tooling to automate vulnerability discovery, reconnaissance, and pentesting workflows
• Have a track record of building security programs and automations from scratch, applying risk-based prioritization
• Have experience performing security reviews and building or improving security review automation
• Have excellent communication skills, allowing you to explain complex security concepts clearly to technical and non-technical stakeholders
• Understand industry standards, and actively keep up with emerging security technologies and models
• Are a team player who drives security change via collaboration and cross-functional partnerships
• Hold offensive security certifications such as OSCP, OSWE, OSEP, GXPN, GPEN, or CRTO
• Have published CVEs, original security research, or conference talks

• Have experience with container escape, Kubernetes attack paths, or cloud red teaming
• Have experience testing AI/ML systems for issues like prompt injection, model extraction, and data poisoning

What to Expect

• Meet with security team and key partners across engineering
• Gain access to team owned systems, and internal documentation
• Complete security awareness training and compliance onboarding
• Review application architecture, tech stack and data flow
• Review risk registry and annual roadmap
• Familiarize oneself with team workflows and processes
• Shadow a fellow security engineer during their on-call/secops rotations

• Conduct security review on emerging Docker products
• Scope and execute your first penetration test against a Docker product or service
• Actively participate in architecture design reviews with the team
• Contribute to a Security-owned project or initiative
• Collaborate with Docker developers to validate and resolve discovered vulnerabilities
• Enhance incident response capabilities by participating in on-call rotation and post-incident activities
• Create and maintain security documentation and runbooks

First Year Outlook

• Contribute to the security roadmap for improving security controls
• Strengthen Zero Trust architecture and least privilege access controls
• Enhance security monitoring and anomaly detection
• Perform security reviews for major product releases
• Own and run recurring penetration tests and adversary-emulation exercises across Docker products, and engage with external researchers
• Support audits and ensure compliance with SOC 2, ISO 27xxx
• Advocate for “security by design” in all product features
• Become well versed in Docker products and emerging AI technologies

Docker does not offer visa sponsorship for this role.

Compensation & Equity

Canada: CA$271,150 – CA$434,000 + equity

United States: $194,150 – $312,950 + equity

Posting Information

• Open vacancy: This posting is for an existing open role.
• AI in hiring: Docker may use AI-assisted tools during our recruiting process.
• Interview recordings: Candidates will be invited to opt in to interview recordings to support interviewer calibration and consistent evaluations. Recordings are optional and require explicit consent.

• Remote-first by design – Work from your home, with offices in Seattle and Paris for connection and collaboration.
• Flexibility that fits your life – We trust you to manage your schedule while delivering great work.
• Time to recharge – Generous PTO, designated quarterly Whaleness Days, and a designated end-of-year Whaleness break.
• Home office support – Set up your workspace for comfort and success.
• Technology stipend – Equivalent to US$100 net per month to help support your work.
• Learning & development – Annual stipend for conferences, courses, certifications, and continued learning.
• Parental leave – 16 weeks of paid parental leave after six months of employment.
• Equity for all full-time employees – Share in Docker's long-term success as we continue to grow.
• Comprehensive benefits – Medical, retirement, and paid holidays vary by country.
• Docker swag – Because representing the whale never gets old.

#LI-REMOTE