Senior Software Engineer - Secure Build

Success in This Role Looks Like

You will succeed by becoming an end-to-end owner for secure, reliable build infrastructure. Within your first year, you should have delivered a material secure-build or CI capability, reduced operational risk in Docker Build Cloud or Auto Builds, and become a trusted partner to the teams and customers that consume the platform.

Responsibilities

• Turn developer, agent and security problems into clear requirements, staged technical decisions and measurable outcomes.
• Design, build and operate Go services and APIs that power Docker's build and secure-CI infrastructure.
• Develop isolation, identity, policy, provenance, attestation and signing capabilities for trusted build and test jobs.
• Work with container, OCI, BuildKit, cloud and isolated-execution technologies to deliver secure and reproducible workflows.
• Own features from technical design through rollout, observability, incident response and ongoing maintenance.
• Keep Docker Build Cloud and Auto Builds reliable, make targeted improvements that reduce operational load, and help their capabilities evolve towards the wider Secure Build direction.
• Make practical security trade-offs and use threat modelling to guide designs without blocking delivery.
• Design for a clear developer experience, including workflows initiated or consumed by software agents.
• Partner with Product, Security, Developer Experience, Registry and other platform teams on end-to-end customer workflows.
• Participate in the team's paid on-call rotation and drive improvements from incidents and recurring operational work.
• Communicate decisions, risks and progress clearly in a remote, async-first environment.

Qualifications

Required

• 6+ years of software engineering experience, with demonstrated technical leadership on production systems at scale.
• Bachelor’s degree in Computer Science, Engineering, or a related field, or equivalent practical experience
• Strong backend engineering experience building and operating distributed systems in production.
• Production experience with Go and the ability to write, test, review and debug maintainable Go services.
• Experience with containers and build or CI systems, such as OCI, BuildKit, Buildx, GitHub Actions or comparable platforms.
• Experience with cloud-native infrastructure and a major cloud platform.
• A strong operational mindset covering observability, reliability, incident response and on-call ownership.
• Evidence of taking a feature or service from an ambiguous problem through production operation and measurable results.
• Working knowledge of security boundaries, identity, secrets and common software supply-chain risks.
• A strong product mindset and care for developer workflows, including experiences used by software agents.
• Clear written and spoken communication suited to a remote, async-first company.

Helpful, but not required

• Experience with Kubernetes.
• Experience with SLSA, in-toto, SBOM, VEX, Sigstore, cosign, provenance or artefact signing.
• Experience with sandboxing, microVMs, untrusted workload execution or multi-tenant infrastructure.
• Experience building hosted CI runners, remote builders or developer-platform infrastructure.
• Experience with agentic development workflows or building systems used programmatically by software agents.
• Experience evolving a legacy production system while delivering new capabilities.

What to Expect

First 30 Days

• Build context on Docker Build Cloud, Auto Builds and the Secure Build product and technical direction.
• Pair with the Secure Build team on core services, deployments and operational practices.
• Ship a useful production change and take part in an operational review or incident-learning session.
• Understand the secure-CI threat model and build relationships with DHI, Registry and Developer Experience.

First 90 Days

• Own a secure-build feature or reliability improvement from problem definition through production.
• Contribute materially to the secure-CI architecture, including isolation, identity, policy or signed evidence.
• Deliver an observable improvement to the reliability or operability of an existing build service.
• Demonstrate strong product judgement across developer and agent workflows.

One Year Outlook (First Year)

• Be a trusted senior technical owner on the Secure Build team.
• Deliver a material secure-CI or trusted-build capability used by customers or internal product teams.
• Improve the reliability and maintainability of Docker Build Cloud and Auto Builds while helping their useful capabilities converge with the wider platform.
• Contribute to the team's architecture for isolated execution, brokered access and verifiable build outcomes.
• Help establish strong product, design, review and operational practices as the team grows.