Container Security Engineer
Location : Toronto, Canada
T4 Contract Role
Work model : Hybrid (3-4 days to office)
JD:
Roles and Responsibilities:
- Design, deploy and manage containerized environments using Kubernetes, GKE (Google Kubernetes Engine), AKS, or similar platform.
- Document security configurations, procedures and guidelines for containerized environments, ensuring compliance with organizational standards and regulatory requirements.
- Develop and maintain security tools, scripts, and automation workflows to enhance container security operations and incident response capabilities.
- Utilize IaC (Infrastructure-as-Code) tools such as Terraform to automate infrastructure provisioning, ensure consistent configuration and prevent drift.
- Work with microservice architecture, designing APIs, managing Ingress controllers, and implementing service meshes for improved scalability and security.
- Develop CI/CD Pipelines using GitHub Actions/Workflows to build and deploy containers.
- Stay updated with emerging security threats and industry best practices related to container security and cloud-native technologies.
- Consult with vulnerability assessments, security audits and penetration testing to identity security gaps within containerized environments.
- Address security gaps identified within containerized environments.
- Provide guidance and support to developers and operations teams on secure containerization practices, images scanning and runtime protection.
- Own container image lifecycle management, including approved base images, registry governance, versioning and tagging standards, digest pinning, image promotion across environments, retention, deprecation, and removal of vulnerable or obsolete images.
- Integrate Software Bill of Materials (SBOM) generation, validation, storage, and analysis into CI/CD pipelines for container images, using machine-readable formats such as SPDX or CycloneDX.
- Implement container image signing, provenance and attestation controls, and policy enforcement to verify image integrity and approved software supply chain sources before deployment.
- Participate in incident response activities, security incident investigations and post-mortem analysis to improve incident handling processes.
- Document security configurations, procedures and guidelines for containerized environments, ensuring compliance with organizational standards and regulatory requirements.
- Monitor containerized environments to optimize performance and utilization
- Develop and Test Disaster Recovery (DR) and Business Continuity Plans (BCP)
Required Skills:
- 7+ years of experience with Google cloud computing platform.
- 7+ years of experience with container technologies such as Kubernetes, Google Kubernetes Engine (GKE) GDC, AKS, Docker, Podman.
- Hands-on experience generating, consuming, validating, and managing SBOMs for container images, including SPDX and CycloneDX formats and integration with CI/CD and vulnerability management workflows.
- Strong knowledge of enterprise container image management, including OCI registries, image naming and tagging standards, immutable digests, approved base image catalogs, promotion workflows, retention policies, and image lifecycle governance.
- Experience implementing container image security controls, including vulnerability and malware scanning, secrets detection, image signing, provenance, attestations, admission policies, and remediation of vulnerable image components.
- Experience with container supply chain and image security tooling such as Aqua Security, Wiz, Trivy, Syft, Grype, Cosign, or equivalent enterprise tools.
- Familiarity with Cloud PaaS Services such as Google Cloud Run, Google GKE Autopilot and Anthos Service Mesh
- Experience developing CI/CD pipelines using technologies such as GitHub Actions, Jenkins.
- Experience using IaC (Infrastructure-as-Code) tools such as Terraform, ARM, Bicep.
- Strong understanding of DevOps/Platform Engineering principals.
- Strong programming/scripting skills in languages such as Python, Go, bash/shell, Java, NodeJS.
- Familiarity with Cloud CLIs and SDKs.
- Familiarity writing/consuming REST APIs.
- Strong understanding of Network security principles, encryption protocols and identity management concepts.
- Strong understanding of Kubernetes Resource Types (i.e. Cluster Roles, Services, Deployments etc.)
- Experience developing Helm Charts
- Experience implementing Kubernetes technologies such as Network Policies, Service Mesh, Certificate Manager, Ingress Controllers
- Experience developing compliance policies/scripts using tools such as Google Org Policy, Aquasec, Wiz.
- Knowledge of monitoring tools such as Datadog, Grafana, and Prometheus.
- Strong fundamental knowledge of Operating Systems (RHEL, Ubuntu)
- Demonstrated knowledge of container provisioning and administration, cloud bursting, cloud interoperability, cloud disaster recovery and business continuity strategies.
- Understanding of Public Key Infrastructure (PKI), managing public key and private key certificates in Cloud environment for Paas services and applications
- Excellent written and verbal communication skills with the ability to communicate clearly with all levels within the team.
- Critical thinker with strong research and analytics skills.
- Initiative-taking individual with a positive attitude and an ability to work independently and in a team.
Professional certifications such as Certified Kubernetes Administrator (CKA), Certified Kubernetes Security Specialist (CKS), Certified Terraform Associate or other relevant security certifications (i.e. CISSP, CISM)
