Kubernetes and Container Platform Security Specialist

Verda; Helsinki; Hybrid; EUR 140,000 - 190,000; Full time

Benefits offered by this job

Cash and equity compensation

Fringe benefits

Global team exposure

Impactful work

Job summary

Verda in Helsinki or London is seeking a Kubernetes and Container Platform Security Specialist to own the security of Verda's Kubernetes offering: multi-node and single-node clusters, container registry, and registry credentials. The role emphasizes securing tenants and enforcing isolation between workloads, not cluster operations.

You will define security standards, hardening baselines across control plane, nodes, and runtimes, and design network and admission controls.

Qualifications

• Strong production Kubernetes and Linux experience.
• Deep understanding of multi-tenant Kubernetes and isolation requirements.
• Experience with policy-as-code and admission controllers.
• Knowledge of container security, image signing, provenance.
• Ability to define security standards and verify conformance.
• Experience with CVE analysis or upstream contribution is a plus.

Responsibilities

• Own the security design of Verda's Kubernetes offering, registry, and credentials.
• Define tenant isolation model for shared Kubernetes infrastructure.
• Oversee GPU surface security like device plugins and privileged workloads.
• Define hardening baseline for control plane, nodes, runtimes, and secrets.
• Design the network security model: CNI policies, L3/L4/L7 controls.
• Specify runtime detection requirements for SOC and red-team exercises.
• Assess advisories against Verda configurations and support audits.

Skills

Kubernetes security engineering

Linux system administration

Multi-tenant Kubernetes

Policy-as-code / admission control

Container security / image provenance

Security design & threat modeling

Job description

At Verda, we're building a full-stack AI cloud, covering everything from data centers and hardware to our own cloud platform that the world's leading AI teams use to do serious AI work.
We strive to make a positive mark on the world through the infrastructure we build and give leading teams a service they can truly depend on. Headquartered in Helsinki, we operate globally with offices in London and San Francisco.
Join Verda while it’s still being built - not once it’s finished.

Why Verda

• Cash and equity compensation along with various fringe benefits.

• Profitable operations with rapid, sustained growth.

• 40+ nationalities, with 6 different ones on the management team.

• A real chance to make an impact and work alongside world class engineers, researchers, and partners across the global AI ecosystem.

About the role

As Kubernetes and Container Platform Security Specialist you own the security of Verda's Kubernetes offering: multi-node and single-node clusters, the container registry, and the credentials that reach it. The workloads running on it are not ours, the tenants do not trust each other, and the boundary between them is what customers are paying for. That is a different problem from securing your own cluster, and it is the center of this role.

This is a securing role rather than a platform engineering one. You would not run the clusters or carry the platform on-call rota. The platform team operates and implements, and you define the security standard and verify what ships against it.

Your responsibilities

In this role, you would be the technical authority on Kubernetes and container platform security at Verda.

• Own the security design of Verda's Kubernetes offering, container registry, and registry credentials, including image provenance, signing, and admission verification requirements

• Own the tenant isolation model on shared Kubernetes infrastructure: namespace, node and cluster boundaries, tenant reachability, and kubelet and API server exposure

• Own the GPU-specific surface that most Kubernetes security work never touches: device plugins, privileged operator workloads, and partitioning boundaries

• Define the Kubernetes hardening baseline across control plane, node OS, container runtime, etcd and secrets handling, and the policy and admission enforcement model behind it, expressed as policy-as-code so conformance is continuously observable

• Design the Kubernetes network security model alongside Network Security: CNI-level policy, L3/L4/L7 controls, DNS and egress policy

• Specify runtime detection requirements for the Security Operations Center to operate and triage, scope assessments and attack simulation for red teams to execute, and act on what both surface

• Judge Kubernetes and container ecosystem advisories against Verda's configuration and set remediation priority, research new releases and ecosystem technology in a lab ahead of production adoption, and support Verda's compliance position through technical evidence and audit support

Your key competencies

• Strong production Kubernetes and Linux experience, at a depth that lets you find problems rather than only configure around them

• Direct experience of multi-tenant Kubernetes: shared clusters, untrusted workloads, isolation as a requirement rather than a nice-to-have

• Deep understanding of Kubernetes architecture, the container runtime layer, and container and image security

• Strong Kubernetes networking, including CNI-level policy design

• Practical experience of policy-as-code and admission control, and working knowledge of software supply chain security: signing, provenance, SBOMs, and what admission-time enforcement actually requires

• Ability to write a standard that someone else implements, verify conformance without owning the change, and influence an engineering team you do not manage

• A research mindset: testing new technology, finding weaknesses, building proofs of concept, and turning findings into requirements that ship

• Comfortable operating with incomplete information and deciding quickly

Nice to have

• GPU infrastructure: device plugins, GPU operators, partitioning, and the privileged workloads they require

• Multi-tenant container registry operation at scale

• eBPF-based observability or runtime security

• Cluster lifecycle and fleet management tooling

• CVE analysis, advisory triage, or upstream contribution in the Kubernetes or CNCF ecosystem

• Confidential computing, or attested execution environments

• Cloud provider, hosting, or another environment where the infrastructure is the product, ideally one certified to ISO 27001, SOC 2 or C5 where you produced the technical evidence

Practicalities

• Location: Helsinki, Finland or London, United Kingdom

• Hybrid mode: working 3 days a week from our Helsinki or London office

• Employment type: full-time and permanent