Senior Security Engineer (Offensive Security)

Join Docker as a Senior Security Engineer, Offensive Security. In this role, you will drive offensive security initiatives, conduct penetration testing, and collaborate with cross-functional teams to enhance security practices. You will have the opportunity to impact Docker's platform and the broader container ecosystem while working in a fast-paced, technically challenging environment.

Responsibilities

• Conduire des tests de sécurité offensifs sur les produits, plateformes et infrastructures cloud de Docker pour identifier et atténuer les vulnérabilités.
• Collaborer avec les équipes d'ingénierie, de produit et de direction pour transformer les résultats des tests en corrections durables et façonner la conception de la sécurité dans chaque produit Docker.
• Développer des exploits de preuve de concept et produire des résultats clairs, classés par risque, avec des recommandations d'atténuation actionnables.
• Are a team player who drives security change via collaboration and cross-functional partnerships
• Have hands-on penetration testing experience across SaaS web applications and APIs., including manual exploitation beyond automated scanners
• Understand AI/ML security risks and mitigations, including prompt injection, data poisoning, model extraction, and adversarial attacks
• Have practical experience using LLMs and agentic tooling to automate vulnerability discovery, reconnaissance, and pentesting workflows
• Understand industry standards, and actively keep up with emerging security technologies and models

Requirements

• Have 3+ years in security engineering, including hands-on offensive security and penetration testing across applications and infrastructure
• Hold offensive security certifications such as OSCP, OSWE, OSEP, GXPN, GPEN, or CRTO
• Possess 2+ years of hands-on development experience in Python or Golang
• Demonstrate deep expertise in authentication, authorization, including technologies like OAuth, cryptography applications and Zero Trust principles
• Can write security tests and develop exploits and proof-of-concepts that find real vulnerabilities in a product
• Have experience performing security reviews and building or improving security review automation
• Are proficient with offensive tooling and techniques such as. Burp Suite, and OWASP frameworks
• Have excellent communication skills, allowing you to explain complex security concepts clearly to technical and non-technical stakeholders
• Have strong hands-on experience with securing cloud ecosystems (e.g. AWS, GCP, Azure)
• Have a track record of building security programs and automations from scratch, applying risk-based prioritization
• Have published CVEs, original security research, or conference talks
• Have experience with container escape, Kubernetes attack paths, or cloud red teaming

Preferred

• Have experience testing AI/ML systems for issues like prompt injection, model extraction, and data poisoning