Remote opportunity at
CanonicalSecurity Software Engineer
Canonical is hiring a Security Software Engineer who will be embedded in product teams. The job is globally remote, and the engineer needs strong self-discipline to…
Career Tools
About This Role
Canonical is hiring a Security Software Engineer who will be embedded in product teams. The job is globally remote, and the engineer needs strong self-discipline to be effective in a spread-out team. Travel is required at least twice a year, usually for about a week at a time. The engineer writes code like any other team member, but the defining purpose is to push the group to think harder about…
Job Description
Canonical is hiring a Security Software Engineer who will be embedded in product teams. The job is globally remote, and the engineer needs strong self-discipline to be effective in a spread-out team. Travel is required at least twice a year, usually for about a week at a time.
The engineer writes code like any other team member, but the defining purpose is to push the group to think harder about security. Methods include threat modeling, tabletop exercises, design reviews of architecture, static analysis and fuzz testing. Every product engineering group at Canonical holds one or two slots for security-focused engineers.
The scope covers product security as a whole: building features, responding to vulnerabilities, proactive hardening and taking part in open source communities. A few products exist purely because of security needs, such as the kernel-level AppArmor work and the Ubuntu Security Guide. Canonical also carries long-term security response for Ubuntu and the wider open source world, which means coordinating across tens of thousands of upstream projects.
Typical tasks include designing and documenting new security features, leading security efforts inside a team, and analyzing and repairing vulnerabilities in open source code. The engineer may audit source code, contribute to Ubuntu and upstream projects, add tools to security pipelines, and advise other teams on good practice. Work on FIPS and Common Criteria compliance for Linux cryptography, CIS benchmarks and hardening automation for Ubuntu is part of the picture.
Candidates should have a strong academic background and a first degree in computer science or a related STEM subject, or a persuasive alternative route, along with a history of exceeding expectations. A working grasp of common vulnerability classes and their remedies is expected, together with working skill in at least one of Python, Go, Rust, C, C++, Java, Ruby, PHP, JavaScript or TypeScript. Experience with Linux, ideally Debian or Ubuntu, and with building security into a secure development lifecycle, is required.
Responsibilities
- Design and document new security features
- Lead security efforts within a product engineering team
- Analyze and repair vulnerabilities in open source software
- Audit source code for weaknesses
- Add new tools to security infrastructure, pipelines and processes
- Help the team earn and keep security certifications
- Build hardening automation for Ubuntu and CIS benchmarks with external partners
- Advise other engineering teams on security practice
Requirements
- Strong academic background from school and university
- A first degree in computer science or a STEM discipline, or a convincing alternative route
- History of going well beyond what is asked
- Solid knowledge of common vulnerability categories and how to fix them
- Working knowledge of modern engineering methods and open source tooling
- Working skill in at least one of Python, Go, Rust, C, C++, Java, Ruby, PHP, JavaScript or TypeScript
- Experience as a security champion and in building security into the development lifecycle
- Clear professional English, written and spoken
- Experience with Linux, ideally Debian or Ubuntu
- Self-motivation and accountability in a globally spread team
Qualifications
- Experience working on the Linux kernel
- Experience with certifications, including FIPS and Common Criteria
- Familiarity with OVAL, OpenSSL and Libgcrypt
- Understanding of low-level cryptography APIs in Linux
- Performance engineering experience
Core Skills
Benefits
- Remote-first setup with in-person team sprints twice a year
- Yearly USD 2,000 allowance for personal skill development
- Yearly pay review, performance-linked bonus and recognition awards
- Paid annual leave plus maternity and paternity leave
- Confidential employee support program
- Chances to visit new cities and meet teammates in person
- Priority Pass access and upgraded seats on long-haul company trips
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
Is the Security Software Engineer role remote?
Yes. The posting describes it as a globally remote role.
How much travel does the role require?
Travel is required at least twice a year, usually for about one week each time.
Which programming languages are needed?
The posting asks for working skill in at least one of Python, Go, Rust, C, C++, Java, Ruby, PHP, JavaScript or TypeScript.
Is a salary stated?
No salary figure is given. The posting says pay considers location, experience and performance.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.