Apply on Employer Site

PHIZENIX · 1 month ago

Security Engineer (K3s Security & Isolation Specialist)

Hillsboro, OR

Full-time

Onsite

Mid, Senior Level

Phizenix is focused on enhancing security in Kubernetes environments, and they are seeking a Security Engineer to harden and isolate K3s clusters. The role involves implementing security measures, enforcing policies, and ensuring multi-tenant isolation to minimize risks in case of a security breach.

Information Technology & Services

Responsibilities

Design and implement security-first cluster configurations for K3s nodes

Enforce mandatory access control (MAC) using SELinux and AppArmor profiles for pods and system services

Integrate TPM-based attestation and secure boot for cluster nodes to ensure trust in hardware and OS integrity

Establish node, pod, and namespace isolation strategies to reduce lateral movement risk

Harden cluster components (API server, etcd, kubelet) following CIS and NSA Kubernetes security benchmarks

Define and enforce workload sandboxing strategies (seccomp, AppArmor, SELinux contexts, gVisor/Kata if applicable)

Configure minimal privilege policies (RBAC, PodSecurityStandards, NetworkPolicies) to ensure least-privilege execution

Implement namespace, node pool, and hardware partitioning to confine workloads and protect sensitive applications

Apply resource quotas, limits, and scheduling constraints to contain denial-of-service blast radius

Work with Security team to ensure strong identity, authentication, and authorization models

Integrate TPM-backed secrets storage and HSM/KMS systems for cryptographic operations

Ensure secure distribution of workload secrets with solutions like SealedSecrets, HashiCorp Vault, or SOPS

Enforce image signing and verification with cosign or Notary

Integrate SBOM scanning and vulnerability management into CI/CD pipelines

Monitor workloads for runtime anomalies (Falco, Cilium Tetragon, or equivalent)

Apply kernel hardening measures (seccomp-bpf, kernel lockdown, IMA/EVM with TPM)

Build observability hooks for security events (audit logs, syscall monitoring, TPM attestations)

Define blast radius response runbooks for compromised pods or nodes

Work with SRE and Security teams to test chaos/security drills simulating breaches

K3s cluster baseline hardened with SELinux and AppArmor profiles

TPM-enabled secure boot and node attestation pipeline

Enforced PodSecurityStandards and workload sandboxing (seccomp, gVisor/Kata optional)

Documentation of isolation strategies (namespaces, node pools, network segmentation)

Audit-ready evidence of compliance with CIS/NSA Kubernetes security benchmarks

Security runbooks for containment and blast radius reduction

Qualification

K3s/Kubernetes internalsSELinuxAppArmorTPMPod SecurityRBACNetworkPoliciesLinux kernel securityContainer runtimesIncident responseForensic data collectionAudit loggingSupply chain securityConfidential computing