{"id":2177839,"url":"https://alion.io/job/scality-platform-security-engineer","title":"Platform Security Engineer","company":{"id":171914,"name":"Scality","domain":"scality.com","url":"https://alion.io/company/scality","size_band":"1-10","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Lever","truth_index":null},"role":"Security","role_family":"Security","seniority":"junior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Paris, France"],"countries":["FR"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":32000,"max_usd":91000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":477},"experience_years_min":2,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Amazon S3","optional":false},{"name":"Bash","optional":false},{"name":"CI/CD","optional":false},{"name":"Claude Code","optional":false},{"name":"CVE","optional":false},{"name":"Git","optional":false},{"name":"GitHub Actions","optional":false},{"name":"Jira","optional":false},{"name":"Linux","optional":false},{"name":"OpenSSL","optional":false},{"name":"Python","optional":false},{"name":"SBOM","optional":false},{"name":"Ansible","optional":true},{"name":"containerd","optional":true},{"name":"CVSS","optional":true},{"name":"Docker","optional":true},{"name":"Grype","optional":true},{"name":"Red Hat","optional":true},{"name":"Syft","optional":true},{"name":"Trivy","optional":true}],"status":"live","first_seen_at":"2026-10-09T13:25:08Z","employer_posted_date":"2026-10-09","last_verified_at":"2026-10-12T07:20:56Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"At Scality, we build software that stores and protects the world’s most critical data - running on Linux, inside some of the largest infrastructures on the planet, at exabyte scale, for organizations that cannot afford to fail.\nWe are looking for a Platform Security Engineer to join our platform and delivery team in Paris. This is a new seat, and it exists because security work needs dedicated capacity. Absorbed as background tasks between feature tickets, it never gets the focus it deserves. You would be that dedicated capacity.\nThis is a Linux-first, hands-on engineering role. You will not write policies for other people to implement - you will write the Python and Bash that hardens our OS, automates our vulnerability management, and proves to auditors and customers that our supply chain is sound.\nAbout Scality\nScality is the leader in software-defined object storage, trusted by 1,000+ enterprises and 700M+ users worldwide across banking, healthcare, and government sectors - exactly the sectors where security posture is a purchasing criterion, not a checkbox.\nIndustry recognition:\nGartner Magic Quadrant Leader for 9 consecutive years - the only 100% software-defined storage company to hold this position since the quadrant’s inception\n #1 on the GigaOm Radar for Enterprise Object Storage (2024), ahead of 17 competing vendors\nGold Stevie Award 2025 - ARTESCA 3.0, Cloud Storage & Backup Solution category\nNet Promoter Score of 85 across RING and ARTESCA\nAbout the team\nYou will join a small team of highly skilled Linux engineers responsible for delivering and maintaining ADI (Scality Autonomous Data Infrastructure), our full platform: RING (object storage), S3C (S3-compatible layer), and SCOS (Scality OS - our own Linux distribution).\nThe team works across the full stack of infrastructure engineering - deep Linux system integration, RPM packaging, CI/CD pipelines, monitoring, and release automation. The command line is where most of our day happens, and we ship a Linux distribution to customers.\nHow We Build\nWe build with AI tools, in earnest rather than as an experiment. Every engineer here has Claude Code, and it is part of how we write, review, and ship code day to day.\nWe are also designing something larger: an AI code and delivery factory - AI woven into the build and release chain itself, not just into the editor. That work is early and still being thought through rather than already solved. We expect it to become part of how we maintain the platform, and CVE remediation is one of the first places we think it fits: an automated path from advisory to assessment to a patched, tested, delivered build.\nIf that sounds like a problem you would want to work on, this role sits close to it.\nOne principle is not negotiable: a human owns the outcome. AI writes code here, and when it does, we own what it produces - the review, the decision to ship, the consequences, and the fix. “The tool did it” is not an explanation we accept from ourselves, and it is not one we would offer a customer. In security work that matters doubly: an answer you cannot defend is worse than no answer at all.\nHow This Role Works\nScality is building a network of security engineers across the engineering department - a security peer embedded in each development team, rather than a central security function working at arm’s length from the code. You would be that peer for the platform and delivery team.\nSecurity priorities are owned by our VP of Engineering. The agenda is set at that level, with dedicated resources committed across the teams. You will not have to invent it alone - and you will have a voice in it: the engineers closest to the code help decide what goes on the roadmap. We will be straight with you: today security work competes with delivery commitments and too often loses. Naming an owner and funding dedicated people is how we intend to change that. You would help build that capability, not inherit a finished one.\nThe team is accountable for the deliveries. Security items sit on the team’s plate alongside everything else it commits to, rather than in a separate function filing tickets from the outside.\nYou are the dedicated resource that makes them happen. While your teammates carry releases, OS compatibility, and platform features, your time is reserved for the security work. That focus is the whole reason the seat exists.\nYou share the team’s perimeter and its knowledge. Same repositories, same Jira projects, same code reviews, same sprint rituals. The engineers around you have rare, hard-earned Linux depth - OS integration, RPM packaging, boot and GRUB, CI/CD, monitoring - and you will learn the platform from them.\nYou will have peers. Security engineers embedded in the other development teams work the same problems on different perimeters. That network is where you compare notes, share tooling, and grow into the craft.\nThe point of the model is that security decisions get made inside the team that builds and ships the product, by someone who understands the build system rather than filing tickets against it.\nYour First Missions\nTwo priorities are already on the roadmap, and they will shape your first year.\n1. CVE exposure, answered before it is asked\nCustomers in banking, healthcare, and government ask us, routinely and under their own audit obligations, whether our products are exposed to a given CVE. That will not stop - for them, asking is the compliance requirement. Today each answer is researched from scratch: a customer question becomes a ticket, the ticket becomes a hunt through SBOMs, vendor advisories, and our own configuration, and the round trip can take weeks to produce something the team is not fully confident defending.\nYour first mission is to invert that, so the answer already exists when the question arrives.\n A standing exposure record, per shipped component and per release: what the SBOM says is present, what the upstream vendor has decided (including “will not fix”, which is common on RHEL 8 and often the real answer), and whether the vulnerable code path is actually reachable in our configuration\nReachability over presence. A module shipped and loaded by a distribution default is not the same as a module configured on a live URL. That distinction is the difference between “vulnerable” and “no impact”, and it is where the engineering judgement lives\nContinuous CVE detection across our repositories, vendored third-party modules, container images, and shipped RPMs\nWiring detection into our existing SBOM tooling and GitHub Actions pipelines, so exposure is computed when a release is built rather than when a customer asks\nA defined interface with the security engineers and the customer-facing teams: who produces the technical assessment, who owns the wording that reaches the customer, and how both meet the response commitments in our customer security policy\nDurable capture. An assessment that lives only in a ticket comment gets re-derived next release. Findings belong somewhere queryable\nA remediation loop with clear ownership and response targets, integrated with how the team already works in Jira\nAI-assisted remediation, where it fits: from advisory to proposed patch to a tested build, with a human deciding what ships\nDone well, a customer’s “are you affected by X?” becomes a lookup and an afternoon, not an escalation and three weeks.\n2. Raising the security baseline of SCOS\nSCOS is our own Linux distribution - we control the kickstarts, the package set, the boot path, and the images. That is unusual leverage, and we intend to use it. You will drive platform-level hardening across the OS we ship:\nA hardened, defensible default configuration for the distribution\nAdvancing SELinux enforcement across RING and S3C (work already begun on the team, which you will help carry)\nSupply-chain integrity: artifact provenance, signing, dependency currency, reproducible and verifiable builds\nSecrets and credential handling across the delivery pipeline\nCryptographic posture - including FIPS 140-3 readiness, which matters concretely: FIPS 140-2 certificates move to NIST’s historical list on 22 September 2026, and RHEL 9’s validated OpenSSL, GnuTLS, and kernel crypto modules are the foundation we build on\nCompliance-driven engineering work, notably the supply-chain security expectations of NIS2 (Article 21(2)(d)) and the EU Cyber Resilience Act - translated into automation and evidence, not spreadsheets\nYou will also contribute to what comes next: threat modelling of the platform, hardening guidance for customers, and security review of significant design changes.\nWhat We Are Looking For\nThis is a role for someone early in their career who wants to grow into being their team’s security reference. We expect to invest in you, and we expect you to keep growing here for as long as you want to - there is no ceiling built into this seat.\nRequired\nLinux is your primary operating system - at work, at home, or both. You are comfortable in the terminal and you reach for a shell before a UI\nRoughly 2-4 years of relevant experience, or a shorter track record with unusually strong evidence of the skills below\nSolid working ability in Python and Bash - you will be writing and maintaining real code in a production codebase\nA genuine, demonstrable interest in security. We care much more about this than about formal credentials. Show it however it is true for you: CTFs, a home lab, reading advisories and CVE writeups for fun, a hardening project, security-adjacent contributions, a blog, anything real\nComfortable using Git in a collaborative environment\nAbility to read and understand existing code before modifying it\nThe judgement to tell a real risk from a scanner’s opinion - and the instinct to check whether vulnerable code is actually reachable before calling it exposed\nThe willingness to say plainly when you are not yet sure, rather than producing an answer you could not defend\n French - the team works in French day to day\nWritten communication skills in English\nNice to Have\nCVE triage, CVSS scoring, or vulnerability management experience\nReading vendor advisories and understanding vendor triage - NVD, RHSA, Red Hat severity and will-not-fix calls\nSupply-chain security tooling - SBOM formats (SPDX, CycloneDX), scanners (Trivy, Grype, Syft), artifact signing\nRPM packaging or Linux distribution internals\nSELinux policy work\nCI/CD systems, especially GitHub Actions\nRHEL / Rocky Linux (versions 8 and 9)\nContainers (Docker, containerd, systemd units)\nAnsible or Salt\nAwareness of NIS2, the Cyber Resilience Act, or FIPS 140-3\nFamiliarity with S3 or object storage concepts\nSerious use of AI coding tools in a real workflow - Claude Code or equivalent, beyond autocomplete\nTo Be Clear About Scope\nThis is a software engineering role with a security mandate. It is not a SOC or incident-response analyst position, not a penetration-testing role, and not a GRC or compliance-documentation role. If what you want is to build the tooling and harden the system yourself, in code, you are in the right place.\nWhat We Offer\nDedicated focus. Security is your job here, not the thing you get to after the sprint work is done\nClear direction, and a say in it. Security priorities are owned by our VP of Engineering, and the team is accountable for delivering them. You would not be inventing the agenda on your own, you would help shape what goes on it, and you would be part of making it stick\nA network of peers. Security engineers embedded in the other development teams, working the same problems on different perimeters\nWork that compounds. Customer security questions are a permanent obligation, so every assessment you make reusable and every check you automate keeps paying back, release after release\n Modern tooling, actually adopted. Claude Code in every engineer’s hands, and a real say in how AI reshapes our build and delivery chain\nA rare combination: security work with the leverage of owning the whole stack, down to our own Linu...","description_format":"text","description_chars":12457,"description_truncated":true,"requirements":{"experience_years_min":2,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"All levels","optional":false}]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Enterprise Storage Systems","Cloud Storage & File Sharing"],"lifecycle":[{"event":"open","at":"2026-10-09T14:24:07Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":2,"expected_fill_days":22,"reasons":["conf:4","win:early","comp:junior"],"computed_at":"2026-10-12T06:55:09Z"},"pay":null,"html_url":"https://alion.io/job/scality-platform-security-engineer","json_url":"https://alion.io/job/scality-platform-security-engineer.json","meta":{"generated_at":"2026-10-12T12:13:45Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":18979,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-13T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":171914},"rest":"https://alion.io/mcp/rest/get_company?id=171914"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fscality-platform-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fscality-platform-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fscality-platform-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/scality-platform-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fscality-platform-security-engineer"}]}