Staff Product Security Engineer
Chainguard4 hours ago
Base Salary
$205k - $231k/yr
Responsibilities
- Drive product security strategy and execution across products, platforms, and engineering teams.
- Lead the secure SDLC and AI SDLC, including policies, guardrails, secure workflows, review practices, and automation.
- Conduct secure architecture reviews and threat modeling for high-impact systems.
- Lead vulnerability reduction, security automation, policy-as-code, and cloud or container security initiatives.
- Integrate static and dynamic analysis, dependency and license checks, infrastructure-as-code scanners, and AI-related controls into developer workflows and CI/CD.
- Improve the effectiveness of penetration tests, vulnerability assessments, bug bounty programs, and red-team exercises.
- Translate SOC 2, ISO 27001, NIST, and SLSA requirements into practical engineering controls.
- Influence senior stakeholders, mentor Product Security Engineers, and raise security maturity across the engineering organization.
Requirements
- 7+ years of experience in software, product, application, or cloud security.
- Experience driving security programs from design through rollout, such as secure SDLC, AI SDLC, vulnerability management, platform hardening, or security automation.
- Practical understanding of software development and the ability to translate security requirements into adoptable engineering workflows.
- Strong hands-on familiarity with containers, Kubernetes, public cloud, and related security controls.
- Experience with SOC 2, ISO 27001, NIST, or SLSA and translating controls into engineering work.
- Ability to automate security workflows using at least one language such as Go, Python, or Shell and integrate them into CI/CD.
- Ability to influence and align teams through concise communication in a remote-first environment.
- Strong ownership, accountability, adaptability, and ability to navigate ambiguity.
- Experience designing or operating an AI SDLC, AI security program, or governance model is preferred.
- Preferred experience includes software supply-chain security, SBOMs, provenance, signing, build-system hardening, red-teaming, offensive security, security-sensitive open-source development, SAST, DAST, SCA, IaC scanning, policy-as-code, public speaking, standards communities, or high-growth companies.
Benefits
- Remote-first work across the United States, UK, and Canada, with team meetups, bi-annual destination summits, and a monthly coworking, phone, and internet stipend.
- Stock options upon hire and promotion, participation in secondary offerings, and a 10-year exercise window.
- 100% covered health, vision, and dental insurance premiums for employees and dependents.
- Flexible time off.
- Paid parental leave of 18 weeks for birthing parents and 12 weeks for non-birthing parents.
Tech Stack
Categories
About Chainguard
Chainguard provides secure, hardened container images and production-ready builds of open source software for enterprises and developers, typically sold via subscriptions and support. Its offerings include Chainguard Images and tools for software supply chain security; the company also maintains Wolfi, a container-focused Linux distribution. Founded in 2021 and headquartered in Kirkland, WA, Chainguard’s customers include organizations such as OpenAI, Snowflake, and Hewlett Packard Enterprise.