Staff Software Engineer, Image Build & Release

Horizon3

1d•$229,500 - $260,000•Remote

About The Position

The Staff Software Engineer on the Image Build & Release team serves as the technical anchor for building and delivering NodeZero to customer environments. NodeZero runs as a container in customer infrastructure, so the role owns the systems that build images, deliver them reliably, and update deployed instances safely at scale. The engineer sets technical direction for the build pipeline, image signing and scanning strategy, and over-the-air (OTA) delivery infrastructure. This is a hands-on staff-level role involving coding, architecture design, mentoring, and ownership of consequential technical decisions for packaging and shipping NodeZero. The engineer will improve automation, reliability, and delivery velocity, and will own build and release infrastructure end-to-end. The role reports to the Client Platform Engineering Manager and works directly with the OTA Services team on delivery. Horizon3 is a remote-first cybersecurity company. The position may require up to 5% travel and requires a minimum 25 Mbps consumer-grade broadband connection. The stated base salary range is $229,500–$260,000 annually; the role may also be eligible for stock options. The company describes its work environment as inclusive, collaborative, and supportive of career development.

Requirements

At least 8 years of professional software engineering experience, with deep specialization in build systems, CI/CD, or release engineering for containerized applications.
Expert-level knowledge of Docker and container image construction, including multi-stage builds, base image selection, layer optimization, and image hardening.
Experience with container image signing and verification, such as Cosign, Notary, or equivalent.
Experience with image-scanning toolchains, such as Trivy, Grype, Snyk, or equivalent.
A strong track record building and operating CI/CD pipelines at scale, using GitHub Actions, GitLab CI, Tekton, or equivalent.
Deep understanding of Kubernetes, including how images are pulled, versioned, and updated in running clusters.
Experience designing and operating OTA or remote-update systems, including rollout strategies, delta delivery, version negotiation, and rollback.
Proficiency in Go, Python, or shell scripting sufficient to build and maintain pipeline tooling.
Experience with artifact registries such as ECR, GCR, Docker Hub, or Harbor, and with artifact lifecycle management.
A track record of setting engineering standards adopted by other engineers.
Ability to produce clear architecture documents and drive technical decisions across team boundaries.
Experience mentoring mid-level engineers through design and code review.
Minimum 25 Mbps consumer-grade broadband connection.
Ability to travel up to 5% as required for success in the role.

Nice To Haves

Experience with secure software supply-chain practices such as SLSA, SBOM generation, and provenance attestation.
Cybersecurity background or experience building software for sensitive customer environments, including on-premises, air-gapped, or regulated-industry environments.
Experience with Helm chart packaging and Kubernetes operator patterns.
Familiarity with eBPF or kernel-level tooling relevant to containerized security software.

Responsibilities

Design and own the CI/CD pipeline that produces NodeZero container images, from source through signed and scanned artifacts ready for distribution.
Define image hardening, CVE scanning, and signing strategies to meet security and compliance requirements before images ship.
Partner with the OTA Services team to design reliable and safe delivery of image updates to customer-deployed NodeZero instances, including rollout strategy, rollback, and version pinning.
Set standards for build reproducibility, artifact versioning, and release gating across the Client Platform team.
Mentor P4 engineers through code review, design review, and architectural pairing, and help resolve difficult systems problems.
Own build and release infrastructure end-to-end, including on-call responsibility for pipeline failures, build-time regressions, and delivery incidents.
Write code, produce architecture designs, and drive technical decisions for how NodeZero is packaged and shipped.