Senior Supply Chain Security Engineer (East Coast Preferred)

The role

You will build and maintain Docker Hardened Images, including security-hardened system packages, container images, and Helm charts. You will work across upstream OSS projects, vulnerability remediation, and automated factory improvements.

What you will do

• Author and maintain definitions for hardened system packages and container images.
• Adapt and maintain upstream Helm charts for Kubernetes security constraints.
• Track upstream releases, semver patterns, and dependency chains.
• Triage and remediate vulnerabilities across OS packages, dependencies, images and charts.
• Write and improve Go-based integration tests, validators and policy checks.
• Review human-authored and machine-authored pull requests.
• Improve the DHI Factory by converting repeated work into automation.
• Partner with Product, Security, Support and customer-facing teams.
• Engage with upstream maintainers regarding hardened deployment requirements.
• Participate in the team's paid on-call rotation.

Required qualifications

• Strong experience with containers, Linux and Kubernetes in production or production-shaped environments.
• Practical experience reading, adapting or maintaining Helm charts.
• Experience maintaining software you did not originate, such as Linux packages, container images, open-source integrations, charts or a comparable downstream distribution.
• Strong YAML and configuration-review skills.
• Working knowledge of container and Kubernetes security.
• Practical programming ability in Go or a comparable language.
• Experience tracking upstream releases and reasoning about semver, breaking changes, dependency graphs and reproducible builds.
• A maintainer mindset.
• Familiarity with GitHub-heavy open-source workflows.
• Comfort using AI-assisted engineering critically.
• A strong operational mindset and clear written and spoken communication suited to a remote, async-first company.

Nice to have

• Experience as a maintainer for Alpine, Debian, Fedora, Wolfi, Homebrew or another package ecosystem.
• Helm chart authorship or meaningful contribution to an upstream chart.
• Experience with SBOMs, VEX, SLSA, Sigstore, cosign, provenance or artefact signing.
• Experience with apk, deb, rpm, Go modules, Maven or Gradle, npm, pip, Cargo or other dependency ecosystems.
• Experience building automation for package, image or chart creation, validation and release.
• Experience with FIPS, FedRAMP, PCI or other regulated and security-conscious environments.

Benefits

• Remote-first by design
• Flexibility that fits your life
• Generous PTO
• Designated quarterly Whaleness Days
• Designated end-of-year Whaleness break
• Home office support
• Technology stipend equivalent to US$100 net per month
• Annual stipend for conferences, courses, certifications, and continued learning
• 16 weeks of paid parental leave after six months of employment
• Equity for all full-time employees
• Medical, retirement, and paid holidays vary by country
• Docker swag

Before you apply

• Docker considers visa sponsorship on a case-by-case basis based on business needs.
• Docker may use AI-assisted tools during our recruiting process.
• Candidates will be invited to opt in to interview recordings.

About the company

Docker is a globally distributed, remote-first team building tools that define how software gets built and delivered. Their products include Docker Desktop, Docker Hub, and Docker Scout.