Senior Security Engineer, Offensive Security

🕒 September 9

🌐 United States, Canada – Remote

🇺🇸 United States – Remote 🇨🇦 Canada – Remote

💵 $194.2k - $312.9k / year

⏰ Full Time

🟠 Senior

👮‍♂️ Cybersecurity / Security Engineer

👻 Ghost score 11%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Docker, Inc

WebsiteLinkedInAll Job Openings

51 - 200 employees

💼 Consulting

☁️ SaaS

💰 $105M Series C on 2022-03

Consulting • SaaS

Docker, Inc is a company that simplifies the lives of developers by tackling the complexity of app development. They offer tools that allow developers to bring their ideas to life through containerization and orchestration, making the development process easier and more efficient. Docker's products, including Docker Desktop and Docker Hub, are widely adopted by millions of developers worldwide, enhancing workflows and providing an integrated development pipeline.

📋 Description

• Drive offensive security at Docker through realistic adversarial testing of products, platforms, and cloud infrastructure • Partner with engineering, product, and leadership to turn findings into durable fixes and shape secure product design • Find and eliminate risks across Docker products and infrastructure using penetration testing, threat modeling, and exploit development • Implement proactive security solutions across AWS, GCP, Azure, containerized environments, and AI/ML products • Contribute to security initiatives aligned with business goals • Support and implement automated security design reviews and vulnerability management • Build software security and architecture expertise and serve as a resource for engineering teams • Design and implement security architecture and controls across Docker products and platforms • Plan, scope, and execute penetration tests and red-team/adversary-emulation engagements • Develop proof-of-concept exploits and risk-rated findings with remediation guidance; retest fixes • Build and maintain offensive security tooling and automation • Perform security reviews and threat modeling of designs, architectures, and code, including emerging AI products • Write automated security tests and exploits • Participate in a rotating on-call schedule, respond to security events, investigate threats, and coordinate remediation • Educate and collaborate with engineering and product teams on security practices • Participate in security incident response • Conduct security reviews and penetration tests during the first 90 days • Contribute to security roadmap, Zero Trust and least-privilege controls, monitoring, anomaly detection, product-release reviews, recurring adversary-emulation exercises, audits, SOC 2 and ISO 27xxx compliance, and security-by-design advocacy

🎯 Requirements

• 3+ years in security engineering, including hands-on offensive security and penetration testing across applications and infrastructure • 2+ years of hands-on development experience in Python or Golang • Deep expertise in authentication and authorization, including OAuth, cryptography applications, and Zero Trust principles • Strong hands-on experience securing cloud ecosystems such as AWS, GCP, and Azure • Hands-on penetration testing experience across SaaS web applications and APIs, including manual exploitation beyond automated scanners • Proficiency with offensive tooling and techniques such as Burp Suite and OWASP frameworks • Ability to write security tests and develop exploits and proof-of-concepts • Understanding of AI/ML security risks and mitigations, including prompt injection, data poisoning, model extraction, and adversarial attacks • Practical experience using LLMs and agentic tooling to automate vulnerability discovery, reconnaissance, and pentesting workflows • Track record of building security programs and automations from scratch using risk-based prioritization • Experience performing security reviews and building or improving security review automation • Excellent communication skills for explaining complex security concepts to technical and non-technical stakeholders • Understanding of industry standards and emerging security technologies and models • Team player who drives security change through collaboration and cross-functional partnerships • Offensive security certification such as OSCP, OSWE, OSEP, GXPN, GPEN, or CRTO • Published CVEs, original security research, or conference talks • Bonus: experience with container escape, Kubernetes attack paths, or cloud red teaming • Bonus: experience testing AI/ML systems for prompt injection, model extraction, and data poisoning • Must be legally authorized to work in the country where applying • Docker does not offer visa sponsorship for this role

🏖️ Benefits

• Remote-first by design – Work from your home, with offices in Seattle and Paris for connection and collaboration. • Flexibility that fits your life • Generous PTO • Designated quarterly Whaleness Days • Designated end-of-year Whaleness break • Home office support • Technology stipend equivalent to US$100 net per month • Annual learning and development stipend for conferences, courses, certifications, and continued learning • 16 weeks of paid parental leave after six months of employment • Equity for all full-time employees • Medical benefits • Retirement benefits • Paid holidays, varying by country • Docker swag