# Senior Supply Chain Security Engineer
**Company:** [Docker](https://scaleengineer.com/companies/docker)
Docker is seeking a Senior Supply Chain Security Engineer to join their Docker Hardened Images (DHI) team, focusing on creating and maintaining security-hardened container images and Helm charts. The role is critical in packaging, securing, and adapting open-source software for enterprise-grade container ecosystems, with a strong emphasis on security, infrastructure, and container technology.
**Role:** Senior Supply Chain Security Engineer
**Seniority:** Senior
**Locations:** Canada
**Remote:** yes
**Salary:** 150000–200000 USD
[Apply](https://jobs.ashbyhq.com/docker/4ed87069-a913-4dc8-8ee2-7f954ab3586f)
Canonical: https://scaleengineer.com/jobs/docker/senior-supply-chain-security-engineer
---
## Responsibilities

- Image Definition Management: Author and maintain image definition files tracking upstream OSS project releases, defining build steps, and keeping the catalogue current across multiple images
- Helm Chart Adaptation: Modify upstream Helm charts to work with DHI images, addressing security constraints, non-root contexts, and Kubernetes compatibility concerns
- Version Tracking: Monitor upstream version releases and semver patterns across monorepos and standard repositories, managing major version breaks and dependency chains
- Integration Testing: Develop Go-based integration tests to validate image and chart behavior in real Kubernetes environments
- Security Hardening: Triage CVEs and contribute to security hardening decisions across container images
- Code Review: Review peers' definitions and chart pull requests against established conventions, identifying and preventing potential issues

## Requirements

### education

- {"name":"Academic Background","description":"Bachelor's degree in Computer Science, Engineering, or related field, or equivalent practical experience"}

### technical

- {"name":"Container Ecosystem","description":"Extensive familiarity with Kubernetes, container technologies, and related tools like cert-manager, kyverno, grafana, and istio"}
- {"name":"YAML Expertise","description":"Advanced understanding of YAML structure, conventions, and configuration patterns"}
- {"name":"Go Programming","description":"Proficiency in Go for writing integration tests and reading source code"}
- {"name":"Container Security","description":"Comprehensive knowledge of container security fundamentals including non-root users, UID/GID management, image layers, and supply chain security"}

### experience

- {"name":"Backend Engineering","description":"6+ years of production-grade backend engineering experience"}

## Skills

### required

- {"name":"Container Security","description":"Deep understanding of container security principles and implementation"}
- {"name":"Kubernetes","description":"Hands-on experience with Kubernetes ecosystem and deployments"}
- {"name":"Open Source Workflows","description":"Proficiency with GitHub-based open source collaboration methods"}

### preferred

- {"name":"Package Maintenance","description":"Experience maintaining packages for Linux distributions or package managers"}
- {"name":"Helm Charts","description":"Prior experience authoring or contributing to Helm charts"}
- {"name":"Supply Chain Tooling","description":"Familiarity with supply chain security tools like Sigstore, SBOM, and SLSA"}

## Tech stack

### tools

- {"name":"Docker","description":"Containerization platform"}
- {"name":"GitHub","description":"Version control and collaboration platform"}

### others

- {"name":"Container Security Tools","description":"Sigstore, SBOM, SLSA frameworks"}

### databases

### languages

- {"name":"Go","description":"Primary language for test development and system interactions"}
- {"name":"YAML","description":"Primary configuration and definition language"}

### frameworks

- {"name":"Kubernetes","description":"Container orchestration platform"}
- {"name":"Helm","description":"Kubernetes package management framework"}

## Benefits

### benefits

- {"name":"Remote Work Flexibility","description":"Remote-first culture with work flexibility to fit life around work"}
- {"name":"Quarterly Breaks","description":"Designated quarterly Whaleness Days and end-of-year Whaleness break"}
- {"name":"Home Office Support","description":"Home office setup with technology stipend of $100 USD/month"}
- {"name":"Parental Leave","description":"16 weeks of paid parental leave after 6 months of employment"}
- {"name":"Professional Development","description":"Training stipend for conferences, courses, and classes"}
- {"name":"Equity Compensation","description":"Stock options to share in the company's success"}

## Compensation

- **max:** 200000
- **min:** 150000
- **currency:** USD
- **stockOptions:** true

## Interview process

### steps

- {"name":"Initial Screening","description":"Review of application and initial candidate assessment"}
- {"name":"Technical Interview","description":"Detailed discussion of container security, Kubernetes, and technical capabilities"}
- {"name":"Practical Assessment","description":"Hands-on evaluation of skills in YAML configuration, container security, and test development"}
- {"name":"Final Interview","description":"Discussion with team leadership about role fit and long-term potential"}

## Full description
Docker has been one of the most loved brands in developer tooling, trusted by more than 20 million monthly users and over 20 billion container image pulls. From solo founders to the world's largest companies, developers rely on Docker to build, share, and run their applications across our suite of products including Docker Desktop, Docker Hub, and Docker Scout.  
  
We are a globally distributed, remote-first team building the tools that define how software gets built and delivered. As AI agents redefine software development, Docker is at the center of that shift, providing the sandboxed environments, verified images, and secure infrastructure that make autonomous workflows trustworthy by default.

Docker Hardened Images (DHI) is Docker's catalogue of security-hardened, enterprise-grade container images and Helm charts - built to be minimal, up-to-date, and safe to deploy in regulated and security-conscious environments. We're looking for someone to join the team that makes this possible.

This is not a traditional software engineering role. You'll spend most of your time working with YAML definition files, upstream OSS projects, and the container and Kubernetes ecosystems - packaging and adapting software rather than building it from scratch. If you've ever maintained packages for a Linux distribution, contributed to a Helm chart upstream, or worked as a platform/infrastructure engineer with a strong security lean, this will feel familiar.

# Responsibilities 

* Authoring and maintaining image definition files that track upstream OSS project releases, define build steps, and keep our catalogue current across dozens of images
* Adapting upstream Helm charts (cert-manager, grafana, mongodb, kyverno, and many more) to work with DHI images - handling security constraints, non-root contexts, and Kubernetes compatibility concerns
* Tracking upstream version releases and semver patterns across monorepos and standard repos, handling major version breaks and dependency chains
* Writing Go-based integration tests that validate images and charts behave correctly in real Kubernetes environments
* Triaging CVEs and contributing to security hardening decisions across images
* Reviewing peers' definitions and chart PRs against established conventions and catching subtle issues before they reach customers

# Qualifications

* 6+ years of backend engineering experience with production-grade systems
* Bachelor’s degree in Computer Science, Engineering, or a related field, or equivalent practical experience
* Strong familiarity with the container and Kubernetes ecosystem - you know what cert-manager, kyverno, grafana, and istio are, you've deployed them, and you can read upstream Helm chart source without getting lost
* Comfort with YAML as a primary working medium - you think carefully about structure, conventions, and patterns
* Understanding of container security basics - non-root users, UID/GID, image layers, multi-arch builds, supply chain concepts
* Some Go ability - enough to read and write test code, not to build distributed systems
* A maintainer mindset - you take pride in consistency, catch drift from patterns, and think about how your change affects others downstream
* Familiarity with GitHub-heavy open source workflows - PRs, upstream tracking, monorepo conventions

## Bonus

* Experience as a package maintainer (any Linux distribution, Homebrew, etc.)
* Helm chart authorship or contribution experience
* Familiarity with supply chain tooling (Sigstore, SBOM, SLSA)
* Experience in a regulated or security-conscious environment

**Docker considers sponsorship on a case-by-case basis based on business needs.**

We use Covey as part of our hiring and / or promotional process for jobs in NYC and certain features may qualify it as an AEDT. As part of the evaluation process we provide Covey with job requirements and candidate submitted applications. We began using [Covey Scout for Inbound](https://getcovey.com/product/covey-scout-inbound) on April 13, 2024.

Please see the independent bias audit report covering our use of Covey [here](https://getcovey.com/nyc-local-law-144).

**Perks**

* Freedom & flexibility; fit your work around your life
* Designated quarterly Whaleness Days plus end of year Whaleness break
* Home office setup; we want you comfortable while you work
* 16 weeks of paid Parental leave (after 6 months of employment)
* Technology stipend equivalent to $100 USD net/month
* PTO plan that encourages you to take time to do the things you enjoy
* Training stipend for conferences, courses and classes
* Equity; we are a growing start-up and want all employees to have a share in the success of the company
* Docker Swag
* Medical benefits, retirement and holidays vary by country
* Remote-first culture, with offices in Seattle and Paris

Docker embraces diversity and equal opportunity. We are committed to building a team that represents a variety of backgrounds, perspectives, and skills. The more inclusive we are, the better our company will be.

#LI-REMOTE