Kubernetes and Container Platform Security Specialist
At Verda, we're building a full-stack AI cloud, covering everything from data centers and hardware to our own cloud platform that the world's leading AI teams use to do serious AI work. We strive to make a positive mark on the world through the infrastructure we build and give leading teams a service they can truly depend on. Headquartered in Helsinki, we operate globally with offices in London and San Francisco. Join Verda while it’s still being built - not once it’s finished.
Why Verda Cash and equity compensation along with various fringe benefits (healthcare, lunch, wellbeing, and more).
Profitable operations with rapid, sustained growth.
40+ nationalities, with 6 different ones on the management team.
A real chance to make an impact and work alongside world class engineers, researchers, and partners across the global AI ecosystem.
About the role As Kubernetes and Container Platform Security Specialist you own the security of Verda's Kubernetes offering: multi-node and single-node clusters, the container registry, and the credentials that reach it. The workloads running on it are not ours, the tenants do not trust each other, and the boundary between them is what customers are paying for. That is a different problem from securing your own cluster, and it is the centre of this role. This is a securing role rather than a platform engineering one. You would not run the clusters or carry the platform on-call rota. The platform team operates and implements, and you define the security standard and verify what ships against it.
Your responsibilities In this role, you would be the technical authority on Kubernetes and container platform security at Verda. Own the security design of Verda's Kubernetes offering, container registry, and registry credentials, including image provenance, signing, and admission verification requirements
Own the tenant isolation model on shared Kubernetes infrastructure: namespace, node and cluster boundaries, tenant reachability, and kubelet and API server exposure
Own the GPU-specific surface that most Kubernetes security work never touches: device plugins, privileged operator workloads, and partitioning boundaries
Define the Kubernetes hardening baseline across control plane, node OS, container runtime, etcd and secrets handling, and the policy and admission enforcement model behind it, expressed as policy-as-code so conformance is continuously observable
Design the Kubernetes network security model alongside Network Security: CNI-level policy, L3/L4/L7 controls, DNS and egress policy
Specify runtime detection requirements for the Security Operations Centre to operate and triage, scope assessments and attack simulation for red teams to execute, and act on what both surface
Judge Kubernetes and container ecosystem advisories against Verda's configuration and set remediation priority, research new releases and ecosystem technology in a lab ahead of production adoption, and support Verda's compliance position through technical evidence and audit support
Your key competencies Strong production Kubernetes and Linux experience, at a depth that lets you find problems rather than only configure around them
Direct experience of multi-tenant Kubernetes: shared clusters, untrusted workloads, isolation as a requirement rather than a nice-to-have
Deep understanding of Kubernetes architecture, the container runtime layer, and container and image security
Strong Kubernetes networking, including CNI-level policy design
Practical experience of policy-as-code and admission control, and working knowledge of software supply chain security: signing, provenance, SBOMs, and what admission-time enforcement actually requires
Ability to write a standard that someone else implements, verify conformance without owning the change, and influence an engineering team you do not manage
A research mindset: testing new technology, finding weaknesses, building proofs of concept, and turning findings into requirements that ship
Comfortable operating with incomplete information and deciding quickly
Nice to have GPU infrastructure: device plugins, GPU operators, partitioning, and the privileged workloads they require
Multi-tenant container registry operation at scale
eBPF-based observability or runtime security
Cluster lifecycle and fleet management tooling
CVE analysis, advisory triage, or upstream contribution in the Kubernetes or CNCF ecosystem
Confidential computing, or attested execution environments
Cloud provider, hosting, or another environment where the infrastructure is the product, ideally one certified to ISO 27001, SOC 2 or C5 where you produced the technical evidence
Practicalities Location: Helsinki, Finland or London, United Kingdom
Hybrid mode: working 3 days a week from our Helsinki or London office
Employment type: full-time and permanent
What's next We're building fast and this role needs the right person behind it. There's no artificial deadline, but when we find who we're looking for, we move. If this sounds like your next move, apply now. Please submit your application through our Careers page. We don't accept applications sent by email.