Job Title: SecurityEngineer (K3s Security & Isolation Specialist)

Location: Hillsboro, Oregon  (Hybrid) (Relocation cost will be reimbursed)

Context:

The Security Engineer will focus on hardening and isolating K3s clusters to minimize blast radius in the event of compromise. This includes enforcing Linux security modules (SELinux, AppArmor), leveraging TPM for secure boot and attestation, implementing least privilege across nodes and workloads, and ensuring multi-tenant isolation within hybrid Kubernetes environments (x86, ARM, accelerators).

Responsibilities

Security Architecture & Policy Enforcement

• Design and implementsecurity-first cluster configurations for K3s nodes.
• Enforcemandatory access control (MAC) using SELinux and AppArmor profiles for pods and system services.
• IntegrateTPM-based attestation and secure boot for cluster nodes to ensure trust in hardware and OS integrity.
• Establishnode, pod, and namespace isolation strategies to reduce lateral movement risk.
• Harden cluster components (API server,etcd, kubelet) following CIS and NSA Kubernetes security benchmarks.

Blast Radius Reduction

• Define and enforceworkload sandboxing strategies (seccomp, AppArmor, SELinuxcontexts, gVisor/Kata if applicable).
• Configureminimal privilege policies (RBAC, PodSecurityStandards, NetworkPolicies) to ensure least-privilege execution.
• Implementnamespace, node pool, and hardware partitioning to confine workloads and protect sensitive applications.
• Applyresource quotas, limits, and scheduling constraints to contain denial-of-service blast radius.

Integration with Identity & Secrets Management

• Work with Security team to ensure strongidentity, authentication, and authorizationmodels.
• IntegrateTPM-backed secrets storage and HSM/KMS systems for cryptographic operations.
• Ensure secure distribution of workload secrets with solutions likeSealedSecrets, HashiCorp Vault, or SOPS.

Runtime & Supply Chain Security

• Enforceimage signing and verification with cosign or Notary.
• IntegrateSBOM scanning and vulnerability management into CI/CD pipelines.
• Monitor workloads for runtime anomalies (Falco, Cilium Tetragon, or equivalent).
• Applykernel hardening measures (seccomp-bpf, kernel lockdown, IMA/EVM with TPM).

Monitoring & Incident Response

• Build observability hooks forsecurity events (audit logs, syscall monitoring, TPM attestations).
• Defineblast radius response runbooks for compromised pods or nodes.
• Work with SRE and Security teams to testchaos/security drills simulating breaches.

Deliverables

• K3s cluster baseline hardened withSELinux and AppArmor profiles.
• TPM-enabled secure boot and node attestation pipeline.
• EnforcedPodSecurityStandards and workload sandboxing (seccomp, gVisor/Kata optional).
• Documentation ofisolation strategies (namespaces, node pools, network segmentation).
• Audit-ready evidence of compliance with CIS/NSA Kubernetes security benchmarks.
• Security runbooks for containment and blast radius reduction.

Required Skills & Experience

• Strong knowledge ofK3s/Kubernetes internals, especially security features.
• Hands-on experience withSELinux, AppArmor, seccomp, and Linux capabilities.
• Experience withTPM (Trusted Platform Module) for secure boot and attestation.
• Deep understanding ofPod Security (PodSecurityPolicies/Standards, OPA/Gatekeeper/Kyverno).
• Experience implementingRBAC, NetworkPolicies, and workload isolation at scale.
• Proficiency inLinux kernel security mechanisms and debugging.
• Familiarity withcontainer runtimes (containerd, CRI-O, gVisor, Kata) and their security implications.
• Strong background inincident response, forensic data collection, and audit logging in Kubernetes.

Nice to Have

• Contributions toKubernetes SIG-Security or open-source security tooling.
• Experience withsupply chain security frameworks (SLSA, NIST 800-190).
• Familiarity withconfidential computing (TEE/SGX/SEV) for workload isolation.
• Hands-on withCilium Tetragon, Falco, or other runtime security tools.
• Knowledge ofair-gapped deployments and hardened Linux distributions (e.g., Flatcar, Bottlerocket).