Docker
Senior Supply Chain Security Engineer (East Coast Preferred)
$155K–$251K
Canada +1 · Remote · Senior · Full-time · Posted May 12, 2026
- Location
- Canada
United States - Visa sponsorship
- Docker considers visa sponsorship on a case-by-case basis based on business needs.
About the job
Own and improve Docker Hardened Images content across packages, container images, and Helm charts, from upstream analysis and security remediation through testing, release, and ongoing maintenance.
What you'll do
- Author and maintain hardened package, image, and chart definitions; track upstream changes and assess dependencies and compatibility.
- Triage and remediate vulnerabilities, and develop Go-based integration tests, validators, policy checks, and factory automation.
- Review contributions, collaborate with internal teams and upstream maintainers, and participate in the paid on-call rotation.
What they ask for
- Strong experience with containers, Linux, Kubernetes, Helm charts, and production or production-shaped environments.
- Experience maintaining software or distributions you did not originate, plus strong YAML and configuration-review skills.
- Working knowledge of container and Kubernetes security, upstream releases, semantic versioning, dependency graphs, and reproducible builds.
- Programming ability in Go or a comparable language, familiarity with GitHub-based open-source workflows, and critical use of AI-assisted engineering.
Nice to have
- Maintainer experience in Alpine, Debian, Fedora, Wolfi, Homebrew, or another package ecosystem; or meaningful upstream Helm chart contributions.
- Experience with SBOMs, VEX, SLSA, Sigstore, cosign, provenance, artifact signing, automation, or regulated environments.
Pay
CA$210,627 – CA$341,690 CAD base salary; $154,600 – $250,800 USD base salary
Tools
Go, YAML, Kubernetes, Helm, GitHub, Alpine, Debian, Wolfi
AI focus
Use AI-assisted engineering extensively in a machine-first content production workflow; retain responsibility for security judgments, evidence, tests, and release quality.
Model-written summary · the original posting is authoritative