Principal Product Security Engineer
Chainguard4 hours ago
Base Salary
$229k - $258k/yr
Responsibilities
- Set product security direction and define security guardrails for AI-assisted development across the software lifecycle.
- Lead multi-quarter, cross-functional security initiatives including secure SDLC improvements and vulnerability reduction.
- Build automation for vulnerability detection, triage, and remediation, including STIGs, CIS baselines, and policy-as-code.
- Improve pentest, vulnerability assessment, bug bounty, and red-team programs so findings lead to lasting engineering and process changes.
- Guide adoption of static and dynamic analysis, dependency and license checks, and IaC scanners within CI/CD workflows.
- Translate SOC 2, ISO 27001, NIST, and NIS2 controls into practical, automation-friendly engineering work.
- Advise senior engineering and product leaders, mentor Product Security Engineers, and track emerging threats and supply-chain risks.
Requirements
- 10+ years of experience in software, product, or application security owning complex products or platforms.
- Deep expertise in secure architecture and system design for cloud-native or distributed systems, including authentication, authorization, and defense-in-depth patterns.
- Experience driving organization-level security and risk programs such as secure SDLC, AI SDLC, and vulnerability management from design through rollout.
- Strong hands-on familiarity with containers, Kubernetes, public cloud environments, and related security controls.
- Experience with security compliance frameworks including SOC 2, ISO 27001, and SLSA.
- Ability to automate security workflows in at least one language such as Go, Python, or Shell and integrate them into CI/CD.
- Ability to influence senior stakeholders and drive cross-team alignment in a remote-first environment.
- Preferred experience includes software supply chain security involving SBOMs, SLSA, provenance, signing, and build-system hardening.
- Preferred experience includes red-teaming or offensive security, open source security-sensitive projects, public speaking or writing on security, industry communities or standards, and early-stage or high-growth companies.
Benefits
- Remote-first work from the United States, Canada, or United Kingdom, with team meetups, bi-annual destination summits, and a monthly coworking, phone, and internet stipend.
- Stock options upon hire and promotion, participation in secondary offerings, and 10-year option exercise periods.
- 100% company-paid health, vision, and dental insurance premiums for employees and dependents.
- Flexible time off.
- Paid parental leave of 18 weeks for birthing parents and 12 weeks for non-birthing parents.
Tech Stack
Categories
About Chainguard
Chainguard provides secure, hardened container images and production-ready builds of open source software for enterprises and developers, typically sold via subscriptions and support. Its offerings include Chainguard Images and tools for software supply chain security; the company also maintains Wolfi, a container-focused Linux distribution. Founded in 2021 and headquartered in Kirkland, WA, Chainguard’s customers include organizations such as OpenAI, Snowflake, and Hewlett Packard Enterprise.