Senior Software Engineer, Patch Engineering & Vulnerability Remediation

Domino Data Lab powers model-driven businesses with its leading Enterprise AI platform trusted by over 20% of the Fortune 100. Domino accelerates the development and deployment of data science work while increasing collaboration and governance. With Domino, enterprises worldwide can develop better medicines, grow more productive crops, build better cars, and much more. Founded in 2013, Domino is backed by Coatue Management, Great Hill Partners, Highland Capital, Sequoia Capital and other leading investors. For more information, visit www.domino.ai The Release Engineering & Vulnerability Remediation team is building the infrastructure and automation that lets Domino ship hardened, auditable software to our most security-sensitive customers—federal agencies, financial institutions, and healthcare organizations operating in regulated or air-gapped environments. This is foundational work. The tooling and runbooks you build will define how Domino operates in regulated markets for years to come.

Responsibilities

Build infrastructure and automation that lets Domino ship hardened, auditable software to security-sensitive customers; Own the hardened image pipeline for the most demanding deployments and cut time-to-remediate for critical and high findings to a published, defensible SLA; Replace one-off vulnerability firefighting with an automated path from scan to fix, including SBOM and exploitability statements generated on every release; Make 'we are not fixing this, and here is why' a documented engineering position backed by evidence; Set the technical direction and tooling that the next engineers on this team build on

Requirements

Experience shipping and maintaining software or container images into regulated, on-premises, or air-gapped environments where you cannot simply redeploy to fix a problem; Deep fluency with container build systems, base image strategy, and reproducible builds, plus working knowledge of Kubernetes and Helm packaging; Hands-on experience with vulnerability scanning and provenance tooling, and the judgment to distinguish a real risk from scanner noise; Go and/or Python strong enough to build automation and to patch upstream open-source dependencies when no fix exists; Clear technical writing; A bias toward removing whole classes of problems rather than closing tickets

Nice to have

Growth mindset; seeking truth and speaking truth; belief that improving is always possible; commitment to teaching and learning; valuing diversity