Senior Security Engineer, Offensive Security

The role

You will drive offensive security by performing penetration testing, threat modeling, and exploit development across Docker products, platforms, and cloud infrastructure. You will partner with engineering and product teams to turn findings into fixes and shape security design.

What you will do

• Contribute to security initiatives that align with business goals
• Support and help implement key security programs like automated security design reviews and vulnerability management
• Build deep knowledge of software security and architecture to act as a resource for engineering teams
• Partner with engineering to design and implement security architecture and controls
• Plan, scope, and execute penetration tests and red-team / adversary-emulation engagements
• Develop proof-of-concept exploits and produce risk-rated findings with remediation guidance
• Build and maintain offensive security tooling and automation
• Perform security reviews and threat modeling across products and services
• Serve on rotating on-call schedule to respond to security events
• Participate in Security Incident response

Required qualifications

• 3+ years in security engineering, including hands-on offensive security and penetration testing across applications and infrastructure
• 2+ years of hands-on development experience in Python or Golang
• Deep expertise in authentication, authorization, including technologies like OAuth, cryptography applications and Zero Trust principles
• Strong hands-on experience in securing cloud ecosystems (e.g. AWS, GCP, Azure)
• Hands-on penetration testing experience across SaaS web applications and APIs, including manual exploitation beyond automated scanners
• Proficient with offensive tooling and techniques such as Burp Suite and OWASP frameworks
• Can write security tests and develop exploits and proof-of-concepts
• Understand AI/ML security risks and mitigations, including prompt injection, data poisoning, model extraction, and adversarial attacks
• Practical experience using LLMs and agentic tooling to automate vulnerability discovery, reconnaissance, and pentesting workflows
• Track record of building security programs and automations from scratch
• Experience performing security reviews and building or improving security review automation
• Excellent communication skills

Nice to have

• Experience with container escape, Kubernetes attack paths, or cloud red teaming
• Experience testing AI/ML systems for issues like prompt injection, model extraction, and data poisoning

Benefits

• Remote-first by design
• Flexibility to manage your schedule
• Generous PTO
• Designated quarterly Whaleness Days
• Designated end-of-year Whaleness break
• Home office support
• Technology stipend equivalent to US$100 net per month
• Annual stipend for conferences, courses, certifications, and continued learning
• 16 weeks of paid parental leave after six months of employment
• Equity for all full-time employees
• Medical, retirement, and paid holidays vary by country
• Docker swag

Before you apply

• Visa sponsorship is not available for this role
• Docker may use AI-assisted tools during the recruiting process
• Candidates may be invited to opt in to interview recordings

About the company

Docker is a globally distributed, remote-first team building tools that define how software gets built and delivered. Their products include Docker Desktop, Docker Hub, and Docker Scout.