Containerization Security Engineer

Role: Containerization Security Engineer

Location: Toronto, ON (4 days Onsite)

Duration: Contract

Required Skills:

• 7+ years of experience with Google cloud computing platform.
• 7+ years of experience with container technologies such as Kubernetes, Google Kubernetes Engine (GKE) GDC, AKS, Docker, Podman.
• Hands-on experience generating, consuming, validating, and managing SBOMs for container images, including SPDX and CycloneDX formats and integration with CI/CD and vulnerability management workflows.
• Strong knowledge of enterprise container image management, including OCI registries, image naming and tagging standards, immutable digests, approved base image catalogs, promotion workflows, retention policies, and image lifecycle governance.
• Experience implementing container image security controls, including vulnerability and malware scanning, secrets detection, image signing, provenance, attestations, admission policies, and remediation of vulnerable image components.
• Experience with container supply chain and image security tooling such as Aqua Security, Wiz, Trivy, Syft, Grype, Cosign, or equivalent enterprise tools.
• Familiarity with Cloud PaaS Services such as Google Cloud Run, Google GKE Autopilot and Anthos Service Mesh
• Experience developing CI/CD pipelines using technologies such as GitHub Actions, Jenkins.
• Experience using IaC (Infrastructure-as-Code) tools such as Terraform, ARM, Bicep.
• Strong understanding of DevOps/Platform Engineering principals.
• Strong programming/scripting skills in languages such as Python, Go, bash/shell, Java, NodeJS.
• Familiarity with Cloud CLIs and SDKs.
• Familiarity writing/consuming REST APIs.
• Strong understanding of Network security principles, encryption protocols and identity management concepts.
• Strong understanding of Kubernetes Resource Types (i.e. Cluster Roles, Services, Deployments etc.)
• Experience developing Helm Charts
• Experience implementing Kubernetes technologies such as Network Policies, Service Mesh, Certificate Manager, Ingress Controllers
• Experience developing compliance policies/scripts using tools such as Google Org Policy, Aquasec, Wiz.
• Knowledge of monitoring tools such as Datadog, Grafana, and Prometheus.
• Strong fundamental knowledge of Operating Systems (RHEL, Ubuntu)
• Demonstrated knowledge of container provisioning and administration, cloud bursting, cloud interoperability, cloud disaster recovery and business continuity strategies.
• Understanding of Public Key Infrastructure (PKI), managing public key and private key certificates in Cloud environment for Paas services and applications

Preferred: Professional certifications such as:

• Certified Kubernetes Administrator (CKA)
• Certified Kubernetes Security Specialist (CKS)
• Certified Terraform Associate or other relevant security certifications (i.e. CISSP, CISM)

Roles and Responsibilities:

• Design, deploy and manage containerized environments using Kubernetes, GKE (Google Kubernetes Engine), AKS, or similar platform.
• Document security configurations, procedures and guidelines for containerized environments, ensuring compliance with organizational standards and regulatory requirements.
• Develop and maintain security tools, scripts, and automation workflows to enhance container security operations and incident response capabilities.
• Utilize IaC (Infrastructure-as-Code) tools such as Terraform to automate infrastructure provisioning, ensure consistent configuration and prevent drift.
• Work with microservice architecture, designing APIs, managing Ingress controllers, and implementing service meshes for improved scalability and security.
• Develop CI/CD Pipelines using GitHub Actions/Workflows to build and deploy containers.
• Stay updated with emerging security threats and industry best practices related to container security and cloud-native technologies.
• Consult with vulnerability assessments, security audits and penetration testing to identity security gaps within containerized environments.
• Address security gaps identified within containerized environments.
• Provide guidance and support to developers and operations teams on secure containerization practices, images scanning and runtime protection.
• Own container image lifecycle management, including approved base images, registry governance, versioning and tagging standards, digest pinning, image promotion across environments, retention, deprecation, and removal of vulnerable or obsolete images.
• Integrate Software Bill of Materials (SBOM) generation, validation, storage, and analysis into CI/CD pipelines for container images, using machine-readable formats such as SPDX or CycloneDX.
• Implement container image signing, provenance and attestation controls, and policy enforcement to verify image integrity and approved software supply chain sources before deployment.
• Participate in incident response activities, security incident investigations and post-mortem analysis to improve incident handling processes.
• Document security configurations, procedures and guidelines for containerized environments, ensuring compliance with organizational standards and regulatory requirements.
• Monitor containerized environments to optimize performance and utilization
• Develop and Test Disaster Recovery (DR) and Business Continuity Plans (BCP)

Thank you

Praveen

praveen.s@themesoft.com