Staff Software Engineer, Sandbox Secrets (West Coast)

Overview

Staff Software Engineer on Docker's Secrets team, designing and building core security systems that power Docker's agentic platform and AI governance products, including secrets management and credential injection.

What you'll do

• Design, develop, and lead improvements to the secrets management and credential injection systems.
• Investigate and resolve security, correctness, performance, and stability issues across cloud, macOS, Windows, and Linux.
• Collaborate with peers, Product, and adjacent teams to evolve the architecture as requirements grow.
• Mentor engineers on the team and set the bar in design reviews and code reviews.
• Engage with the open source and agentic development community around sandboxing, MCP, and related ecosystems.
• Participate in on-call rotations and respond to critical stability issues affecting users.
• Document your work clearly and share knowledge with the rest of the team.

What you'll need

• 8+ years of software engineering experience, with demonstrated technical leadership on production systems at scale.
• Bachelor's degree in Computer Science, Engineering, or a related field, or equivalent practical experience.
• Experience building developer tools, desktop applications, or runtime infrastructure used directly by developers.
• Familiarity with the agentic software development ecosystem: how coding agents work and how tools like Claude Code, Codex, or similar agents interact with their environment.
• Ability to reason about isolation and security boundaries: what a sandbox should and shouldn't expose, and how to make safe defaults obvious to users.
• Experience driving architecture and technical strategy across multiple engineers or teams.
• Strong written and verbal communication skills.
• Comfortable working with a high degree of autonomy in a remote-first environment.

Nice to have

• Strong proficiency in Go, Rust, and/or Java.
• Experience with cryptographic key management systems and techniques (key wrapping, HSMs, cloud KMSes, etc.).
• Familiarity with best practices for protecting credentials and secret material at-rest and in transit.
• Understanding of networking, TLS, HTTP, and the like.
• Understanding of one or more OS-specific credential management capabilities.

Details

• Remote-first role; candidates in the Western time zone (US or Canada) are currently being prioritized.
• Location: United States.
• Full-time role with equity.
• Base salary: US$170,350 – US$275,550.
• Visa sponsorship considered case-by-case based on business needs.
• Participate in on-call rotations.