Senior Software Engineer, Patch Engineering & Vulnerability Remediation

Who we are

At Domino, we build solutions that help the largest, highly regulated organizations adopt AI to accelerate mission-critical use cases. Our platform integrates a streamlined model and app development environment, advanced model, agent, and app hosting capabilities, and novel governance capabilities providing regulator-ready AI at scale. Our customers — like Johnson & Johnson, GSK, Bristol Myers, UBS, FINRA and the US Navy — are using our software to solve some of the most important challenges in the world, such as developing new medicines, securing our financial markets, or protecting our country. Backed by Sequoia Capital, Coatue Management, NVIDIA, Snowflake and other leading investors, we have been in business for over a decade but are still a small team operating with the spirit of a startup. In the world of AI today, we believe that the future is still being invented — and we want to be the ones building it. For more information, visit www.domino.ai

What we are building

The Release Engineering & Vulnerability Remediation team is building the infrastructure and automation that lets Domino ship hardened, auditable software to our most security-sensitive customers—federal agencies, financial institutions, and healthcare organizations operating in regulated or air-gapped environments.

Concretely, we are building:

A hardened release pipeline that produces container images meeting strict scan thresholds, with reproducible builds and minimal attack surface

An automated vulnerability triage system that ingests scanner output, deduplicates findings across images and releases, routes to owners, and tracks SLA compliance—without manual triage

Provenance and exploitability tooling that generates SBOMs and VEX statements on every release, so customer security questions are answered from standing artifacts rather than one-off investigations

A scalable remediation practice that uses AI and automation to keep pace with the volume of findings, rather than throwing engineers at each CVE individually

This is foundational work. The tooling and runbooks you build will define how Domino operates in regulated markets for years to come.

What your impact will be

In your first year, you will

In your first year, you will own the hardened image pipeline for our most demanding deployments and cut time-to-remediate for critical and high findings to a published, defensible SLA.

You will replace one-off vulnerability firefighting with an automated path from scan to fix, including SBOM and exploitability statements generated on every release.