Software Engineer, Supply Chain Security

At Docker, we make app development easier so developers can focus on what matters.

The Supply Chain Security group is remaking software development and operations security through a holistic, developer-first approach to securing software and software artifacts. We are developing an end-to-end solution for securing the container ecosystem, starting in the developer inner loop and continuing through to production, emphasizing ease-of-use and automation every step of the way. This role will initially be focused on secure container images and the system that builds them, working day-to-day with open-source software, Linux distribution packages, BuildKit, GitHub Actions, Docker Scout, and CVEs. Beyond building images, there will be extensive interaction with customers using these images and helping to shape the tooling that makes these images as easy to work with as Docker Official Images.

If you are comfortable in a fast-paced, customer-first environment allowing you to dig into low-level details about how software is built, packaged, and run, this role is for you. Come contribute to creating an amazing developer experience around secure containers with the world’s experts in container images and supply chain security!

Responsibilities:

• Creating and supporting secure container images and related metadata like SBOMs and vulnerabilities

• Maintaining and enhancing SLSA Build Level 3 compliant build system leveraging BuiltKit and GitHub Actions

• Collectively own the security posture and developer experience of using secure container images

Qualifications:

• Experience building container images with BuildKit

• Understanding of low-level container image primitives, i.e., manifests, indices, digests, attestations, etc.

• Familiarity with Linux distributions and compiling software from source

• Experience with continuous integration systems, particularly GitHub Actions

• Knowledge of software security tooling like Docker Scout

What to expect in the first 30 days:

• Integrate into a dynamic team building security-first container images for customers

• Deepen knowledge of container images, container image builds, BuildKit, and vulnerabilities

• Create your first few images with the help of your team

What to expect in the first 90 days:

• Continue to create, maintain, and support secure images

• Improve the image build system

• Deepen your knowledge of images and building images

• Help other new team members onboard

• Regularly interact with customers using the images

• Contribute to custom CVE feed and remediate vulnerabilities across the image catalog

• Work with the team to develop custom-trained generative AI systems for image creation and maintenance

• Begin to enhance image build and deployment user experience

What to expect in the first year:

• Contribute to increased automation and efficiency of the secure image factory

• Continue to help grow the team, interact with customers, and develop more efficient ways to create and maintain secure images using generative AI

• Embrace data-driven tracking and reporting of how the images you are helping to build increase developer productivity while reducing vulnerability exposure

• Grow in your skills beyond image creation and maintenance into developer tooling and backend services supporting developer needs

• In collaboration with your manager, you will have a Career Development Plan that will outline your trajectory beyond your first year.