Senior Software Engineer, Security, Docker Desktop

Accountabilities:

• Contribute directly to the product codebase using Go, focusing on security-sensitive components such as authentication flows, privilege boundaries, and container runtime behavior.
• Integrate security considerations into everyday engineering activities, ensuring new features are developed with secure defaults and robust protection mechanisms.
• Participate in technical design discussions and code reviews, identifying potential security risks and recommending improvements before features are released.
• Conduct threat modeling and security design reviews for new and evolving product capabilities, particularly those involving authentication, authorization, identity management, and container runtime security.
• Act as the primary liaison between the Desktop engineering team and the central security organization, translating security policies and recommendations into practical engineering decisions.
• Manage incoming vulnerability reports and Common Vulnerabilities and Exposures (CVEs), including validating reported issues, assessing severity, reproducing vulnerabilities, and coordinating remediation.
• Oversee vulnerability disclosure processes, collaborating with external security researchers and internal engineering teams to establish appropriate timelines and ensure vulnerabilities are addressed effectively.
• Develop, maintain, and improve internal security documentation, engineering guidelines, procedures, and operational runbooks.
• Monitor developments in Linux and container security, including namespaces, cgroups, seccomp, AppArmor, Linux capabilities, and evolving Open Container Initiative (OCI) standards.
• Identify opportunities to strengthen container isolation, authentication mechanisms, and overall product security through continuous technical improvements.
• Build strong relationships across engineering and security teams, encouraging collaboration and integrating security awareness throughout the software development lifecycle.

Requirements:

• At least 6 years of professional software engineering experience, with meaningful exposure to security-sensitive systems or a strong demonstrated interest in cybersecurity.
• Strong proficiency in Go, with proven experience developing, maintaining, and delivering production-grade software.
• Solid understanding of Linux fundamentals relevant to container security, including namespaces, cgroups, Linux capabilities, seccomp profiles, AppArmor, SELinux, rootless containers, and privilege boundaries.
• Familiarity with OCI specifications, container runtime architecture, and the underlying technologies supporting containerized applications.
• Working knowledge of identity and access management concepts, including OAuth 2.0, OpenID Connect (OIDC), token management, authentication, and authorization workflows.
• Experience or familiarity with security architecture reviews and threat modeling, with the ability to identify potential vulnerabilities and recommend appropriate mitigation strategies.
• Understanding of vulnerability management processes, including CVE triage, CVSS severity scoring, coordinated vulnerability disclosure, and collaboration with external security researchers.
• Ability to balance security requirements with product functionality, performance, maintainability, and practical engineering constraints.
• Strong software engineering fundamentals, with a focus on code quality, reliability, scalability, and secure development practices.
• Proven ability to take ownership of technical initiatives, investigate complex security issues, and drive solutions from initial assessment through implementation.
• Excellent written and verbal communication skills, with the ability to explain complex security concepts and bridge collaboration between dedicated security specialists and product engineering teams.
• Strong analytical and problem-solving abilities, combined with technical curiosity and a proactive approach to continuous improvement.
• Ability to work independently while contributing effectively to a collaborative, globally distributed engineering environment.