- The DHI Content team builds and maintains Docker Hardened Images: a catalogue of security-hardened system packages, container images and Helm charts designed to be minimal, up to date and safe to use in security-conscious and regulated environments

- This is a supply-chain and open-source maintainer role rather than a conventional backend engineering role

- You will work across upstream OSS projects, package and image definitions, Helm charts, Kubernetes, integration tests, vulnerability remediation and the controls that prove content is ready to publish
- The work is broad by design: customers should be able to select hardened packages and images and, where relevant, deploy them through hardened charts without the pieces drifting apart

- We are moving DHI content production towards a machine-first factory. Routine work should begin with a machine-produced change and pass through automated build, test, policy and review controls

- Engineers add the most value by handling difficult ecosystems, making security judgements, improving standards and turning repeated human corrections into better tooling

- You will use AI-assisted engineering extensively, but remain accountable for the evidence and quality behind every result

- As a Senior Supply Chain Security Engineer, you will own substantial content and improvement work from upstream discovery through release and ongoing maintenance

- You will be expected to close the loop on customer and security outcomes, not only submit individual definition changes

- Success in This Role Looks Like

- You will succeed by becoming a trusted end-to-end owner for hardened content

- Within your first year, you should have delivered complex new or updated DHI content across packages, images and Helm charts, improved the factory or its quality gates, reduced recurring manual work and raised the capability of the engineers around you

- Author and maintain definitions for hardened system packages and container images, including build steps, upstream tracking, multi-architecture support and reproducibility controls

- Adapt and maintain upstream Helm charts so they work correctly with DHI images under non-root, restricted and production-shaped Kubernetes security constraints

- Track upstream releases, semver patterns, monorepos, dependency chains and breaking changes, then make pragmatic decisions about when to update, patch, pin or deviate

- Triage and remediate vulnerabilities across OS packages, application dependencies, images and charts, including VEX and no-upstream-fix cases that require explicit security judgement

- Write and improve Go-based integration tests, validators and policy checks that prove packages,



images and charts behave correctly in real environments

- Review human-authored and machine-authored pull requests against DHI standards, distinguish blocking issues from advice and give contributors a clear path forward

- Improve the DHI Factory by converting repeated work, review corrections and escaped defects into automation, tests, validators and reusable authoring patterns

- Help classify work into deterministic, specialist and judgement paths so people spend time where their expertise changes the outcome

- Partner with Product, Security, Support and customer-facing teams to turn demand and incidents into prioritised content and durable improvements

- Engage constructively with upstream maintainers when hardened deployment requirements expose issues or useful improvements

- Participate in the team’s paid on-call rotation and drive learning from customer escalations, failed builds and content defects

- Communicate decisions, risks and progress clearly in a remote, async-first environment

- First 30 Days
- Build context on the DHI catalogue, its package, image and chart definitions, the DHI Factory and the team’s definition of done

- Pair across both image and Helm chart work and ship a useful production change

- Learn the build, test, signing, publishing and vulnerability-remediation workflows

- Take part in reviews and an incident, escalation or failed-build learning session

- First 90 Days
- Own a complex image and chart addition or update from upstream analysis through release

- Resolve a meaningful CVE, dependency or compatibility problem with clear evidence and customer impact in mind

- Improve at least one factory control, integration test, validator or reusable content pattern

- Review across artefact types and help another engineer take on a broader piece of work

- One Year Outlook (First Year)

- Be a trusted senior owner across hardened packages, images and Helm charts

- Deliver material catalogue growth or quality improvements without increasing human effort linearly with demand

- Reduce recurring manual work by moving a class of changes into a proven automated path

- Improve DHI’s security posture, content availability and release reliability for customers





- Raise review quality and grow the team’s ability to work across artefact and dependency ecosystems

Advantages

- 100% company paid medical premiums for employees and dependents

- Flexible Time Off Policy

- Employer Paid Holidays
- Generous Parental Leave (after 6 months of employment)

- Home Office Set Up Budget

- Monthly Technology Stipend

- Training Allowances

- Life and Disability Insurance

- Retirement Plans
- Virtual and In-Person Social Events

- Docker Swag
- Quarterly Hackathons- Practical experience reading, adapting or maintaining Helm charts and diagnosing how chart templates, values and workload security settings affect deployment behaviour

- Practical programming ability in Go or a comparable language, sufficient to write and review integration tests, validators and content automation

- Strong YAML and configuration-review skills, including care for conventions, consistency and downstream impact across a large catalogue

- Working knowledge of container and Kubernetes security, including non-root execution, UID and GID, capabilities, filesystem restrictions, image layers and multi-architecture builds

- Strong experience with containers, Linux and Kubernetes in production or production-shaped environments

- Familiarity with GitHub-heavy open-source workflows, including pull requests, review, release tracking and upstream contribution
- A maintainer mindset: you catch drift, improve patterns for the next contributor and consider the effect of a change across many downstream consumers

- Comfort using AI-assisted engineering critically while retaining ownership of security assertions, test evidence and release quality
- A strong operational mindset and clear written and spoken communication suited to a remote, async-first company

- Experience tracking upstream releases and reasoning about semver, breaking changes, dependency graphs and reproducible builds

- Experience maintaining software you did not originate, such as Linux packages, container images, open-source integrations, charts or a comparable downstream distribution

- Experience with FIPS, FedRAMP, PCI or other regulated and security-conscious environments

- Experience with apk, deb, rpm, Go modules, Maven or Gradle, npm, pip, Cargo or other dependency ecosystems

- Experience with SBOMs, VEX, SLSA, Sigstore, cosign, provenance or artefact signing

- Experience building automation for package, image or chart creation, validation and release

- Helm chart authorship or meaningful contribution to an upstream chart

- Experience as a maintainer for Alpine, Debian, Fedora, Wolfi, Homebrew or another package ecosystem

📌 Senior Supply Chain Security Engineer (Canada)
🏢 Docker
📍 Canada