Security Engineer - Ubuntu

Remote; San Francisco (CA); Remote; USD 130,000 - 180,000; Full time

Job summary

Canonical's Ubuntu security team in San Francisco is seeking a skilled software security engineer to protect open source ecosystems and Ubuntu users from emerging threats. You will monitor, triage, respond to vulnerabilities, and document findings across distributed teams.

You will analyze vulnerabilities, collaborate with upstream developers, and contribute to security assessments, tooling, and community engagements while traveling internationally as needed.

Qualifications

• Strong knowledge of security vulnerabilities and remediation techniques.
• Experience with coordinated disclosure processes.
• Familiarity with open source development workflows and tools.
• Proficiency in at least one of C, Python, Go, Rust, Java, Ruby, or PHP.
• Excellent problem-solving and communication skills.

Responsibilities

• Analyze, fix, and test vulnerabilities in Ubuntu packages.
• Document vulnerabilities and coordinate triage and patching with teams.
• Review code and perform security assessments and tooling development.
• Engage with the Ubuntu community and upstream projects as needed.

Skills

Security vulnerabilities

Coordinated disclosure

Open source tools

C

Python

Go

Rust

Java

Ruby

PHP

Communication

Team collaboration

Job description

This is an exciting opportunity to join an industry leading software security team, and help protect the open source community and Ubuntu users from emerging threats. Canonical is building a team to provide security coverage across a wide range of different ecosystems and environments, and work to make the world a better, safer place.

As part of the Ubuntu team, you will work with the best and brightest people in technology to monitor, triage, respond to and document new and existing vulnerabilities in open source software. The role will involve collaboration with internal teams and external partners, to identify and prioritize issues and track progress.

The role can also include a number of other activities, including security assessment and code review, internal tooling developments, community engagement, security hardening and feature development and industry collaboration participation.

This job involves international travel several times a year, usually for one week and requires the ability to be productive in a globally distributed team through self-discipline and self-motivation.

What you'll do

• Analyze, fix, and test vulnerabilities in Ubuntu packages
• Keep track of vulnerabilities in Ubuntu releases as they are discovered, researched and fixed (using internal software tools)
• Collaborate with other teams in the Ubuntu community and with upstream developers where appropriate, to exchange or develop vulnerability patches and make sure that Ubuntu includes the very best security features
• Audit source code for vulnerabilities

Who you are

• You have a thorough understanding of the common categories of security vulnerabilities and techniques for fixing them
• You are familiar with coordinated disclosure practices
• You are familiar with open source development tools and methodologies
• You are skilled in one or more of C, Python, go, Rust, Java, Ruby or PHP
• You have excellent logic, problem-solving, troubleshooting, and decision-making skills
• You can clearly and effectively communicate with the team and Ubuntu community members

We are proud to foster a workplace free from discrimination. Diversity of experience, perspectives, and background create a better work environment and better products. Whatever your identity we will give your application fair consideration.

#LI-Remote