Staff Vulnerability Management Engineer
Chainguard5 hours ago
Base Salary
$170k - $231k/yr
Responsibilities
- Own measurement, disclosure, and reporting for thousands of novel vulnerabilities identified weekly by frontier models and other sources.
- Calibrate vulnerability response processes based on emerging trends.
- Report newly discovered vulnerabilities to upstream projects and maintainers.
- Run the CNA program and assign new CVEs where necessary.
- Coordinate internal and external embargoes with customers, engineering teams, and external maintainers.
- Coordinate actions and responses with the Linux Foundation, CISA, and other industry bodies.
- Guide industry direction so emerging standards and norms meet customer needs.
- Represent Chainguard externally and visibly in its vulnerability-management efforts.
- Work with AI model vendors to guide the evolution of the software supply chain.
Requirements
- 7+ years of experience in software security, open source maintenance, or vulnerability disclosure management.
- Strong understanding of responsible disclosure.
- Practical expertise automating pipelines and processes at large scale and reducing human-in-the-loop operations.
- Deep experience with open source communities.
- Experience coordinating with public-sector organizations, industry standards bodies, and working groups.
- Preferred: established industry thought leadership in vulnerability disclosure management and embargoes.
- Preferred: familiarity with Chainguard Images or other minimal and hardened container base-image ecosystems.
- Preferred: experience operating a CNA.
- Preferred: software engineering background in Python, Java, JavaScript, Go, or similar languages.
- Preferred: background in security research, penetration testing, or bug bounties.
Benefits
- Flexible remote-first culture with team meetups, bi-annual destination summits, and a monthly coworking, phone, and internet stipend.
- Stock options upon hire and promotion, participation in secondary offerings, and 10 years to exercise options.
- 100% covered health, vision, and dental insurance premiums for employees and dependents.
- Flexible time off.
- Paid parental leave of 18 weeks for birthing parents and 12 weeks for non-birthing parents.
- Individual-contributor role with cross-team and external industry collaboration.
Tech Stack
Categories
About Chainguard
Chainguard is the trusted source for open source. By delivering hardened, secure, and production-ready builds of all the open source software engineers and AI agents rely on, Chainguard helps organizations build faster, stay compliant, and eliminate risk. Its customers include Fortune 500 enterprises and global industry leaders, including Anduril, Canva, Fortinet, Hewlett Packard Enterprise, OpenAI, Snap Inc., and Snowflake. Chainguard is venture-backed by leading investors, including Amplify, IVP, Kleiner Perkins, Lightspeed Venture Partners, Mantis VC, Redpoint Ventures, Sequoia Capital, and Spark Capital. For more information, visit: https://www.chainguard.dev/