Kubernetes and Container Platform Security Specialist

At Verda, we're building a full-stack AI cloud, covering everything from data centers and hardware to our own cloud platform that the world's leading AI teams use to do serious AI work.

We strive to make a positive mark on the world through the infrastructure we build and give leading teams a service they can truly depend on. Headquartered in Helsinki, we operate globally with offices in London and San Francisco.

Join Verda while it’s still being built - not once it’s finished.

Why Verda

Cash and equity compensation along with various fringe benefits (healthcare, lunch, wellbeing, and more).Profitable operations with rapid, sustained growth.40+ nationalities, with 6 different ones on the management team.A real chance to make an impact and work alongside world class engineers, researchers, and partners across the global AI ecosystem.

As Kubernetes and Container Platform Security Specialist you own the security of Verda's Kubernetes offering: multi-node and single-node clusters, the container registry, and the credentials that reach it. The workloads running on it are not ours, the tenants do not trust each other, and the boundary between them is what customers are paying for. That is a different problem from securing your own cluster, and it is the centre of this role.

This is a securing role rather than a platform engineering one. You would not run the clusters or carry the platform on-call rota. The platform team operates and implements, and you define the security standard and verify what ships against it.

Your Responsibilities

In this role, you would be the technical authority on Kubernetes and container platform security at Verda.

Own the security design of Verda's Kubernetes offering, container registry, and registry credentials, including image provenance, signing, and admission verification requirementsOwn the tenant isolation model on shared Kubernetes infrastructure: namespace, node and cluster boundaries, tenant reachability, and kubelet and API server exposureOwn the GPU-specific surface that most Kubernetes security work never touches: device plugins, privileged operator workloads, and partitioning boundariesDefine the Kubernetes hardening baseline across control plane, node OS, container runtime, etcd and secrets handling, and the policy and admission enforcement model behind it, expressed as policy-as-code so conformance is continuously observableDesign the Kubernetes network security model alongside Network Security: CNI-level policy, L3/L4/L7 controls, DNS and egress policySpecify runtime detection requirements for the Security Operations Centre to operate and triage, scope assessments and attack simulation for red teams to execute, and act on what both surfaceJudge Kubernetes and container ecosystem advisories against Verda's configuration and set remediation priority, research new releases and ecosystem technology in a lab ahead of production adoption, and support Verda's compliance position through technical evidence and audit support

Your key competencies

Strong production Kubernetes and Linux experience, at a depth that lets you find problems rather than only configure around themDirect experience of multi-tenant Kubernetes: shared clusters, untrusted workloads, isolation as a requirement rather than a nice-to-haveDeep understanding of Kubernetes architecture, the container runtime layer, and container and image securityStrong Kubernetes networking, including CNI-level policy designPractical experience of policy-as-code and admission control, and working knowledge of software supply chain security: signing, provenance, SBOMs, and what admission-time enforcement actually requiresAbility to write a standard that someone else implements, verify conformance without owning the change, and influence an engineering team you do not manageA research mindset: testing new technology, finding weaknesses, building proofs of concept, and turning findings into requirements that shipComfortable operating with incomplete information and deciding quickly

GPU infrastructure: device plugins, GPU operators, partitioning, and the privileged workloads they requireMulti-tenant container registry operation at scaleeBPF-based observability or runtime securityCluster lifecycle and fleet management toolingCVE analysis, advisory triage, or upstream contribution in the Kubernetes or CNCF ecosystemConfidential computing, or attested execution environmentsCloud provider, hosting, or another environment where the infrastructure is the product, ideally one certified to ISO 27001, SOC 2 or C5 where you produced the technical evidence

Practicalities

Location: Helsinki, Finland or London, United KingdomHybrid mode: working 3 days a week from our Helsinki or London officeEmployment type: full-time and permanent

What's Next

We're building fast and this role needs the right person behind it. There's no artificial deadline, but when we find who we're looking for, we move. If this sounds like your next move, apply now.

Please submit your application through our Careers page. We don't accept applications sent by email.