Security Software Engineer

Accountabilities: • Define, implement, test, and document new security features across software products and infrastructure.

• Lead security-focused initiatives within product engineering teams and promote security throughout the software development lifecycle. • Analyze, reproduce, remediate, and test vulnerabilities in open source software. • Audit source code and software architectures to identify security weaknesses and recommend appropriate mitigations. • Apply threat modeling, architecture and design reviews, tabletop exercises, static analysis, fuzzing, and other proactive security practices. • Contribute security fixes and improvements to Ubuntu and upstream open source projects. • Integrate security tools into development infrastructure, pipelines, and engineering processes. • Design and develop hardening automation for Linux-based environments. • Support security certification initiatives and help maintain compliance with relevant standards. • Extend and enhance Linux cryptographic components to address country-specific compliance requirements, including FIPS and Common Criteria where applicable. • Collaborate with external partners on security initiatives such as Center for Internet Security benchmarks. • Develop, test, and maintain software capabilities supporting security, reliability, and compliance objectives. • Provide security guidance, technical support, and best-practice recommendations to other engineering teams. • Monitor emerging security threats, technologies, methodologies, and industry developments. • Participate in open source communities and contribute to broader security initiatives across the ecosystem.

Requirements:

• Strong professional experience in software engineering with a significant focus on application, product, or infrastructure security. • Thorough understanding of common categories of software security vulnerabilities and effective approaches for identifying and remediating them. • Experience applying modern software engineering and secure development practices. • Demonstrated experience acting as a security champion or driving security initiatives within a broader Software Development Life Cycle (SDLC). • Strong programming skills in one or more of C, C++, Python, Go, Rust, Java, Ruby, PHP, or JavaScript/TypeScript. • Experience working with Linux, with Debian or Ubuntu experience preferred. • Familiarity with open source development tools, workflows, methodologies, and community practices. • Strong understanding of security architecture, secure coding, vulnerability analysis, and software hardening. • Excellent analytical and problem-solving abilities, with a willingness to investigate complex security issues in depth. • Strong communication and presentation skills, with the ability to explain security risks and recommendations clearly to technical stakeholders. • Excellent interpersonal skills, curiosity, flexibility, and accountability. • Strong self-motivation, thoughtful decision-making, and a consistent focus on delivering results. • Professional written and spoken English. • Undergraduate degree in Computer Science, STEM, or a related technical discipline, or a compelling alternative professional background. • Demonstrated ability to take ownership, exceed expectations, and deliver against commitments. • Experience working effectively in globally distributed and asynchronous teams. • Experience with the Linux kernel is advantageous. • Knowledge of FIPS, Common Criteria, or other security certification frameworks is a plus. • Familiarity with OVAL and vulnerability assessment methodologies is beneficial. • Knowledge of cryptographic technologies such as OpenSSL or Libgcrypt is advantageous. • Understanding of low-level Linux cryptography APIs is a plus. • Performance engineering experience and the ability to learn new technologies quickly are valuable additional strengths. • Willingness and ability to travel internationally at least twice a year, typically for approximately one week per event.