Staff Vulnerability Management Engineer
Chainguard2 months ago
Base Salary
$170k - $231k/yr
Responsibilities
- Own measurement, disclosure, and reporting for thousands of novel vulnerabilities identified weekly by frontier models and other sources.
- Calibrate vulnerability response processes based on emerging trends.
- Report newly discovered vulnerabilities to upstream projects and maintainers.
- Run the CNA program and assign new CVEs where necessary.
- Coordinate internal and external embargoes with customers, engineering teams, and external maintainers.
- Coordinate actions and responses with the Linux Foundation, CISA, and other industry bodies.
- Guide industry direction so emerging standards and norms meet customer needs.
- Represent Chainguard externally and visibly in its vulnerability-management efforts.
- Work with AI model vendors to guide the evolution of the software supply chain.
Requirements
- 7+ years of experience in software security, open source maintenance, or vulnerability disclosure management.
- Strong understanding of responsible disclosure.
- Practical expertise automating pipelines and processes at large scale and reducing human-in-the-loop operations.
- Deep experience with open source communities.
- Experience coordinating with public-sector organizations, industry standards bodies, and working groups.
- Preferred: established industry thought leadership in vulnerability disclosure management and embargoes.
- Preferred: familiarity with Chainguard Images or other minimal and hardened container base-image ecosystems.
- Preferred: experience operating a CNA.
- Preferred: software engineering background in Python, Java, JavaScript, Go, or similar languages.
- Preferred: background in security research, penetration testing, or bug bounties.
Benefits
- Flexible remote-first culture with team meetups, bi-annual destination summits, and a monthly coworking, phone, and internet stipend.
- Stock options upon hire and promotion, participation in secondary offerings, and 10 years to exercise options.
- 100% covered health, vision, and dental insurance premiums for employees and dependents.
- Flexible time off.
- Paid parental leave of 18 weeks for birthing parents and 12 weeks for non-birthing parents.
- Individual-contributor role with cross-team and external industry collaboration.
Tech Stack
Categories
About Chainguard
Chainguard provides secure, hardened container images and production-ready builds of open source software for enterprises and developers, typically sold via subscriptions and support. Its offerings include Chainguard Images and tools for software supply chain security; the company also maintains Wolfi, a container-focused Linux distribution. Founded in 2021 and headquartered in Kirkland, WA, Chainguard’s customers include organizations such as OpenAI, Snowflake, and Hewlett Packard Enterprise.