SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Scality is seeking a Platform Security Engineer to join its platform and delivery team in Paris. This is a new, dedicated security role created because security work deserves focused capacity rather than being absorbed as background tasks between feature tickets.
This is a hands-on Linux engineering role where you will write Python and Bash to harden the operating system, automate vulnerability management, and provide auditors and customers with evidence of supply-chain security. You will not write policies for others to implement — you will implement the security work yourself in code.
You will join a small team of highly skilled Linux engineers responsible for Scality's Autonomous Data Infrastructure (ADI), which includes RING (object storage), S3C (S3-compatible layer), and SCOS (Scality's own Linux distribution). The team works across the full stack: deep Linux system integration, RPM packaging, CI/CD pipelines, monitoring, and release automation.
Scality is the leader in software-defined object storage, trusted by 1,000+ enterprises and 700M+ users worldwide across banking, healthcare, and government sectors. The company has been a Gartner Magic Quadrant Leader for 9 consecutive years and ranks #1 on the GigaOm Radar for Enterprise Object Storage.
Your first two major missions will be:
1. CVE Exposure Management: Build a standing exposure record per shipped component and release, automating the process of answering customer CVE questions. Today each answer is researched from scratch and can take weeks; you will invert this so the answer exists when the question arrives. This includes continuous CVE detection across repositories, vendored modules, container images, and shipped RPMs; wiring detection into SBOM tooling and GitHub Actions; and establishing a defined interface with security engineers and customer-facing teams. You will implement AI-assisted remediation where it fits, from advisory to proposed patch to tested build, with humans deciding what ships.
2. SCOS Security Baseline: Drive platform-level hardening across Scality's own Linux distribution. This includes hardened default configurations, advancing SELinux enforcement, supply-chain integrity (artifact provenance, signing, dependency currency, reproducible builds), secrets and credential handling, cryptographic posture (including FIPS 140-3 readiness), and compliance-driven engineering for NIS2 and the EU Cyber Resilience Act. You will also contribute to threat modeling, hardening guidance for customers, and security review of significant design changes.
Scality builds with AI tools in earnest — every engineer has Claude Code and it is part of daily development. The company is designing an AI code and delivery factory woven into the build and release chain itself. One principle is non-negotiable: a human owns the outcome. AI writes code here, but humans own the review, decision to ship, consequences, and fixes.
You will be embedded in the platform and delivery team as a security peer, not working at arm's length from a central function. Security priorities are owned by the VP of Engineering with dedicated resources committed. You will share the team's repositories, Jira projects, code reviews, and sprint rituals. You will have peers — security engineers embedded in other development teams — where you compare notes, share tooling, and grow into the craft.
REQUIREMENTS:
Required:
- Linux is your primary operating system (work, home, or both); comfortable in the terminal
- Approximately 2–4 years of relevant experience, or shorter track record with unusually strong evidence of the skills below
- Solid working ability in Python and Bash — you will write and maintain real code in production
- Genuine, demonstrable interest in security (CTFs, home lab, reading advisories/CVE writeups, hardening projects, security-adjacent contributions, blog, etc.)
- Comfortable using Git in a collaborative environment
- Ability to read and understand existing code before modifying it
- Judgment to distinguish real risks from scanner opinions; instinct to check whether vulnerable code is actually reachable
- Willingness to say plainly when unsure rather than producing indefensible answers
- French language (team works in French day to day)
- Written communication skills in English
Nice to Have:
- CVE triage, CVSS scoring, or vulnerability management experience
- Reading vendor advisories and understanding vendor triage (NVD, RHSA, Red Hat severity and will-not-fix calls)
- Supply-chain security tooling (SBOM formats like SPDX/CycloneDX, scanners like Trivy/Grype/Syft, artifact signing)
- RPM packaging or Linux distribution internals
- SELinux policy work
- CI/CD systems, especially GitHub Actions
- RHEL / Rocky Linux (versions 8 and 9)
- Containers (Docker, containerd, systemd units)
- Ansible or Salt
- Awareness of NIS2, Cyber Resilience Act, or FIPS 140-3
- Familiarity with S3 or object storage concepts
- Serious use of AI coding tools in real workflow (Claude Code or equivalent, beyond autocomplete)
