Senior Security Engineer, Docker Desktop

Responsibilities

• Partner with engineering and product teams throughout the development lifecycle to identify security risks early, from design review through code review and release.
• Conduct threat modeling and security design reviews for new and evolving product features, focusing on authentication, authorization, and container runtime security.
• Serve as the primary liaison to the central security organization, translating policy into practical engineering decisions.
• Act as the first point of contact for vulnerability reports and CVEs: validate severity, reproduce issues, coordinate disclosure timelines, and drive remediation.
• Review Go code for privilege escalation, insecure defaults, injection risks, and improper credential handling.
• Contribute security-focused improvements directly to the codebase.
• Develop and maintain internal security documentation, guidelines, and runbooks.
• Stay current on Linux security for containers, including namespaces, cgroups, seccomp, AppArmor, capabilities, and the OCI ecosystem.
• Participate in an on-call rotation as needed, including evenings, weekends, and holidays.

Requirements

• 6+ years of experience in security engineering, application security, or a closely related discipline, with experience at a senior or staff level.
• Bachelor's degree in Computer Science, Engineering, or a related field, or equivalent practical experience.
• Strong proficiency in Go and the ability to review and contribute to production-grade code.
• Deep understanding of Linux fundamentals relevant to container security, including namespaces, cgroups, capabilities, seccomp profiles, AppArmor/SELinux, rootless containers, and privilege boundaries.
• Strong understanding of OCI specifications and container runtime security, including runc, containerd, and BuildKit.
• Hands-on experience with identity and access management concepts, including OAuth 2.0, OIDC, token handling, and authentication flows.
• Experience with security design reviews, threat modeling, and secure development workflows.
• Familiarity with vulnerability management, CVE triage, CVSS scoring, coordinated disclosure, and external reporters.
• Strong written and verbal communication skills.

Compensation & Equity

• Canada: CA$271,150–CA$434,000 + equity
• United States: $194,150–$312,950 + equity
• EU: €113,860–€186,780 + equity

Benefits

• Flexible remote-first work
• Quarterly Whaleness Days and an end-of-year Whaleness break
• Home office setup
• 16 weeks of paid parental leave after 6 months of employment
• Technology stipend equivalent to $100 USD net per month
• PTO plan
• Training stipend for conferences, courses, and classes
• Equity participation
• Medical benefits, retirement, and holidays varying by country