About CleanStart:

CleanStart is revolutionizing software supply chain security through our advanced
vulnerability database platform and CleanStart product line. We provide hardened,
vulnerability-free containerimages with built-in security, compliance, and performance
benefits. Our mission is to transform container security by eliminating pre-existing
vulnerabilities and providing full visibility and control overthe software supply chain.

Role Overview:

An Associate Systems Engineer, particularly in a "Build" context, focuses on the
practical implementation and maintenance of system infrastructure, often involving
tasks related to software development, build processes, and release management.
They collaborate with developers, QA, and other teams to ensure systems are built,
deployed, and maintained effectively. You will identify, analyze, and document
vulnerabilities in open-source components, with a deep focus on C/Linux packages and
libraries. Your expertise will be crucial in developing strategies to mitigate security risks
and maintain our zero-vulnerability standard across all container packages.

Key Responsibilities:

• Build and Release Engineering:
  This includes setting up and managing build environments, automating build processes, and deploying applications to various environments. This might involve using tools like Maven, Gradle, Jenkins, etc.
• DevOps Practices:
  Familiarity with DevOps principles and tools is crucial for continuous integration
  and continuous delivery (CI/CD) pipelines. This includes using tools like Git,
  Docker, Kubernetes, etc.
• Automation:
  Automating tasks like testing, deployment, and infrastructure management can
  significantly improve efficiency and reliability.
• Troubleshooting:
  Troubleshooting and resolving issues related to system infrastructure, build
  processes, and deployments is a critical part of the role.
• Communication and Collaboration:
  Effective communication and collaboration with development teams, QA, and
  other stakeholders are essential.
• Scripting:
  Experience with scripting languages like Python, Perl, Shell, or Powershell is
  often needed for automating tasks and customizing build processes.
• System Infrastructure:
  Understanding and managing various aspects of system infrastructure, including
  operating systems, networks, and cloud platforms, is also important.
• Knowledge of Software Development Life Cycle (SDLC):
  A general understanding of the SDLC is important for building and releasing
  software applications

Key Skills:

• Coding Languages: Proficiency in languages like C, C++, Python, Java or Go.
  With scripting experience like Bash, Perl, Java Script etc.
• Operating Systems: Experience with Linux and Windows operating systems.
• Networking: Knowledge of network protocols and security concepts.
• Security Best Practices: Understanding of security best practices and industry
  standards.
• Automation: Familiarity with automation tools and scripting.
• Cloud Security: Experience with cloud-based key management services and data
  protection.
• Communication: Excellent written and verbal communication skills.
• Problem-solving: Ability to troubleshoot and resolve complex technical issues.

Required Qualifications:

• 0-2 years of experience in C/C++, Linux systems, Bash/Perl/Python scripting
• Deep understanding of C/Linux package vulnerabilities and security issues
• Experience with tools for scanning and identifying vulnerabilities in packages
• Strong knowledge of Linux package management systems (APK, RPM, DEB)
• Proficiency with Linux environments, particularly Alpine, Ubuntu, and similar
  distributions
• Experience with C code analysis and vulnerability identification
• Strong analytical and problem-solving skills
• Experience generating and analyzing SBOMs (Software Bill of Materials)

Preferred Qualifications:

• Experience with automated vulnerability detection in C/Linux packages
• Knowledge of exploit development and vulnerability validation
• Familiarity with binary analysis tools and techniques
• Experience with FIPS compliance requirements
• Background in Linux systems programming or package development
• Contributions to security research or vulnerability databases
• Understanding of container image security and hardening techniques
• Experience with security attestation and verification systems

‍