Kubernetes and Container Platform Security Specialist

At Verda, we're building a full-stack AI cloud, covering everything from data centers and hardware to our own cloud platform that the world's leading AI teams use to do serious AI work. We strive to make a positive mark on the world through the infrastructure we build and give leading teams a service they can truly depend on. Headquartered in Helsinki, we operate globally with offices in London and San Francisco. Join Verda while it’s still being built - not once it’s finished. WHY VERDA - Cash and equity compensation along with local benefits. - 40+ nationalities, with 6 different ones on the management team. - A real chance to make an impact and work alongside world class engineers, researchers, and partners across the global AI ecosystem. ABOUT THE ROLE As Kubernetes and Container Platform Security Specialist you own the security of Verda's Kubernetes offering: multi-node and single-node clusters, the container registry, and the credentials that reach it. The workloads running on it are not ours, the tenants do not trust each other, and the boundary between them is what customers are paying for. That is a different problem from securing your own cluster, and it is the center of this role. This is a securing role rather than a platform engineering one. You would not run the clusters or carry the platform on-call rota. The platform team operates and implements, and you define the security standard and verify what ships against it. YOUR RESPONSIBILITIES In this role, you would be the technical authority on Kubernetes and container platform security at Verda. - Own the security design of Verda's Kubernetes offering, container registry, and registry credentials, including image provenance, signing, and admission verification requirements - Own the tenant isolation model on shared Kubernetes infrastructure: namespace, node and cluster boundaries, tenant reachability, and kubelet and API server exposure - Own the GPU-specific surface that most Kubernetes security work never touches: device plugins, privileged operator workloads, and partitioning boundaries - Define the Kubernetes hardening baseline across control plane, node OS, container runtime, etcd and secrets handling, and the policy and admission enforcement model behind it, expressed as policy-as-code so conformance is continuously observable - Design the Kubernetes network security model alongside Network Security: CNI-level policy, L3/L4/L7 controls, DNS and egress policy - Specify runtime detection requirements for the Security Operations Center to operate and triage, scope assessments and attack simulation for red teams to execute, and act on what both surface - Judge Kubernetes and container ecosystem advisories against Verda's configuration and set remediation priority, research new releases and ecosystem technology in a lab ahead of production adoption, and support Verda's compliance position through technical evidence and audit support YOUR KEY COMPETENCIES - Strong production Kubernetes and Linux experience, at a depth that lets you find problems rather than only configure around them - Direct experience of multi-tenant Kubernetes: shared clusters, untrusted workloads, isolation as a requirement rather than a nice-to-have - Deep understanding of Kubernetes architecture, the container runtime layer, and container and image security - Strong Kubernetes networking, including CNI-level policy design - Practical experience of policy-as-code and admission control, and working knowledge of software supply chain security: signing, provenance, SBOMs, and what admission-time enforcement actually requires - Ability to write a standard that someone else implements, verify conformance without owning the change, and influence an engineering team you do not manage - A research mindset: testing new technology, finding weaknesses, building proofs of concept, and turning findings into requirements that ship - Comfortable operating with incomplete information and deciding quickly NICE TO HAVE - GPU infrastructure: device plugins, GPU operators, partitioning, and the privileged workloads they require - Multi-tenant container registry operation at scale - eBPF-based observability or runtime security - Cluster lifecycle and fleet management tooling - CVE analysis, advisory triage, or upstream contribution in the Kubernetes or CNCF ecosystem - Confidential computing, or attested execution environments - Cloud provider, hosting, or another environment where the infrastructure is the product, ideally one certified to ISO 27001, SOC 2 or C5 where you produced the technical evidence PRACTICALITIES - Location: Helsinki, Finland or London, United Kingdom or remotely from EU - Hybrid mode: working 3 days a week from our Helsinki or London office, or remotely from EU - Employment type: full-time and permanent WHAT'S NEXT We're building fast and this role needs the right person behind it. There's no artificial deadline, but when we find who we're looking for, we move. If this sounds like your next move, apply now. Please submit your application through our Careers page. We don't accept applications sent by email. By submitting this application, you confirm that the information you provide is accurate. We will process your personal data to assess your application for this role, as described in our Candidate Privacy Policy. Keeping your data to consider you for future roles is optional and only applies if you tick the box in the application form.