Paranoids Senior Container Security Engineer

Description

The company serves hundreds of millions of people worldwide, and its advertising business offers omnichannel tools and data to brands.

The information security team, called The Paranoids, protects a platform that hundreds of millions of people use every day and that attackers target constantly.

You would join Cyber Resilience, which secures the containers, clusters, and cloud and on-premises hosts that run the company's products. The team is growing to expand that program.

You will work hands-on with the people running the container security program to keep workloads safe across cloud and on-premises environments, turn findings into fixes teams can act on, and help the program mature. You will build relationships with platform and product teams, make practical trade-offs between security and developer speed, and keep up with container threats, favouring fixes to root causes.

The role is what you make of it. The container security program has a multi-year roadmap, and you will help shape its direction.

Responsibilities

• Run and improve container image scanning and SBOM tooling in CI/CD pipelines.
• Write container security baselines and practices grounded in industry standards.
• Create detections that enforce those baselines and send findings to the teams that own the affected workloads.
• Build secure-by-default paved roads: hardened base images, policy-as-code guardrails, and self-service tools that teams actually adopt, not just tools they are forced to use.
• Serve as the hands-on expert for securing container workloads on GCP (GKE, Cloud Run, Artifact Registry) and AWS (EKS, ECS/Fargate, ECR).
• Serve as the hands-on expert for on-premises Linux, Baremetal, Windows and other distro hosts that run containers, covering host hardening, runtime configuration, OS patching, and keeping server firmware current.
• Develop and refine AI-assisted workflows with enterprise AI tools (e.g., Claude) to automate vulnerability triage and security policy updates.
• Check AI-generated policy changes, queries, and triage decisions before they reach production, so they are accurate, do not block legitimate builds, and do not miss real vulnerabilities.
• Work with platform engineering, vulnerability operations, and product teams to take container security milestones from design to production.
• Report on container fleet risk, remediation progress, and program metrics to security leadership.

Requirements

• Bachelor's degree in a technical field (e.g., Computer Science, Engineering, Information Security) or equivalent practical experience.
• 5+ years in information security, with at least 3 years in container security, cloud security engineering, or DevSecOps.
• Hands-on work running container vulnerability scanning and SBOM tools in CI/CD (e.g., Grype, Syft, Trivy, Anchore, Snyk Container), including CVE triage and SBOM formats such as SPDX or CycloneDX.
• GCP container security: securing GKE clusters and Cloud Run services, scanning and governing images in Artifact Registry, and handling Security Command Center findings for container workloads.
• On-premises host expertise: hardening enterprise Linux, Baremetal, Windows and other distributions (e.g., RHEL or its derivatives), and running containerd or Docker on bare metal, with kernel isolation features such as namespaces, cgroups, and seccomp.
• Working knowledge of Kubernetes security, including RBAC, namespaces, pod security, and admission control, and how these differ across managed offerings.
• AWS container experience with ECS, Fargate, EKS, and ECR, and the IAM model that governs them.
• Strong grasp of image security basics: base image hygiene, image freshness, end-of-life distribution risk, and image signing and provenance.
• Proficiency in Python and SQL, with the ability to build and maintain data pipelines on Databricks or Spark without dedicated engineering support.
• Comfortable using enterprise AI tools (e.g., Claude, Gemini) in daily security work, such as prompt design, vulnerability triage, query generation, or security workflow automation.
• Preferred: a relevant certification, such as Google Cloud Professional Cloud Security Engineer, Certified Kubernetes Security Specialist (CKS), or AWS Certified Security Specialty, or equivalent hands-on experience.
• Preferred: experience with Binary Authorization, Sigstore/cosign, or policy engines such as OPA Gatekeeper or Kyverno for image signing and admission policy.
• Preferred: familiarity with Kubernetes network policies and east-west segmentation (NetworkPolicy, service mesh or mTLS) to limit lateral movement.
• Preferred: experience evaluating or operating container runtime security tools, including agents for serverless container platforms.
• Preferred: experience running Kubernetes or other container platforms on bare metal or private cloud, and managing server firmware (BIOS/UEFI, BMC) patching and lifecycle.
• Preferred: familiarity with CIS Benchmarks or similar hardening standards for Linux, Docker, and Kubernetes.
• Preferred: background in enterprise vulnerability management, including severity-based SLAs, exception handling, and remediation tracking at scale.
• Preferred: experience prioritising container vulnerabilities by exploitability and reachability in running workloads.
• Preferred: experience with infrastructure as code and IaC scanning, such as Terraform and Checkov.
• Preferred: practical experience building AI-assisted security workflows, including prompt and agent-harness design (tool integration, context, guardrails) and automating parts of a security operations pipeline.

Conditions

Most roles at the company are hybrid and do not need regular office attendance, but you may occasionally be asked to join in-person events or team sessions, with notice given in advance.

Your recruiter will confirm whether a specific role needs regular office attendance, and can answer any questions about how hybrid work applies.

The base pay range is $128,250.00 - $266,875.00/yr, varying with location, skills, and experience.

The package may also include incentive pay, such as a discretionary annual bonus or commissions.

The company is committed to a diverse and inclusive workplace, supported by 11 employee resource groups.

Duties also include following company policy, using sound judgment, working safely and inclusively with others, and protecting business operations and brand integrity.

Benefits

• Healthcare.
• A 401k.
• Backup childcare.
• Education stipends.
• And more.