Principal Linux Security Engineer

Who you are

• Proven work experience in Security and/or Linux Engineering with a focus on the Linux OS
• At least 4 years of experience doing security in Linux and at least 2 years of experience building Linux Packages

What the job involves

• This isn't a traditional job description. It describes the specific person we're looking for: an engineer who understands the Linux operating system from a security perspective
• How security errata works in an operating system (CSAF, VEX, Advisories) and how to create them and use them in various aspects of the systems, from updateinfo in repos to a security feed for security scanners to ingest
• Compliance on an operating system - Building out STIG and DIS profiles. Understanding how to improve OpenSCAP and building Ansible scripts to apply the security profiles, not just applying scripts that someone else built
• Proactive security in an operating system, like build flags, LKRG, SELinux. How to really secure the OS in a way that also allows it to be usable. Not hooking it up to the internet is not an acceptable security answer
• How to build tools to make the above happen faster and interact with AI to speed up development, testing, and release
• CVE scoring - How they are scored and what that means. It doesn’t mean that you know how to look up a score in NIST, but it means you have used the CVSS calculator and you know why it is scored a 7.8 vs. a 5.5
• CVE affectedness - You understand how to determine if a piece of software is affected by a CVE and how different aspects of build and configuration change the affectedness