Kubernetes and Container Platform Security Specialist

Role overview Own the security standards for a multi-tenant Kubernetes and container platform, where customers’ workloads run alongside those of other tenants. You’ll set the technical requirements and assess whether platform changes meet them; cluster operations and on-call duties sit with the platform team.

Responsibilities - Define security requirements for Kubernetes clusters, the container registry, credentials, image provenance, signing, and admission checks. - Design tenant isolation across namespaces, nodes, clusters, network reachability, and access to the kubelet and API server. - Set security requirements for GPU-specific components, including device plugins, privileged operators, and partitioning boundaries. - Establish hardening and policy-as-code standards for the control plane, node operating systems, container runtime, etcd, secrets, and admission enforcement. - Set network security requirements with the network team, including CNI policy, traffic controls, DNS, and egress. - Specify runtime detection and assessment needs, evaluate relevant security advisories, and turn research and findings into requirements that engineering teams can implement.

Requirements - Strong knowledge of Kubernetes and container security, including shared-cluster isolation and control-plane or node exposure. - Experience defining security standards and verifying implementation across teams without directly owning their engineering changes. - Ability to investigate emerging technology, test for weaknesses, build proofs of concept, and translate findings into practical requirements. - Comfort making decisions with incomplete information and communicating technical expectations clearly.

Nice to have - GPU infrastructure security, including device plugins, GPU operators, partitioning, or privileged workloads. - Operating a multi-tenant container registry, or experience with eBPF-based observability or runtime security. - Cluster lifecycle tooling, Kubernetes or CNCF vulnerability analysis, advisory triage, or upstream contributions. - Confidential computing, attested execution, or security work in a cloud, hosting, or infrastructure product environment; experience producing evidence for ISO 27001, SOC 2, or C5 is relevant.

Benefits and work setup - Full-time, permanent role based in Helsinki or London, or remote from the EU. Hybrid work is available from either office. - Cash and equity compensation, plus fringe benefits.