Principal Product Security Engineer
Chainguard4 hours ago
Remote, United KingdomStaff+
Responsibilities
- Set product security strategy and define security guardrails for AI-assisted development across design, coding, testing, review, deployment, and operations.
- Lead multi-quarter, cross-functional security initiatives including secure SDLC improvements and vulnerability reduction.
- Build automation for vulnerability detection, triage, and remediation, including STIGs, CIS baselines, and policy-as-code.
- Improve the use of penetration tests, vulnerability assessments, bug bounty programs, and red-team activity.
- Guide adoption of static and dynamic analysis, dependency and license checks, and infrastructure-as-code scanners in engineering workflows.
- Translate SOC 2, ISO 27001, NIST, NIS2, and related controls into practical, durable engineering processes.
- Track emerging threats and software supply-chain risks and turn them into changes to controls, tooling, and product direction.
- Influence senior engineering and product leaders, mentor Product Security Engineers, and drive alignment across teams.
Requirements
- 10+ years of experience in software, product, or application security with ownership of complex products or platforms.
- Deep expertise in secure architecture and system design for cloud-native or distributed systems, including authentication, authorization, and defense-in-depth patterns.
- Experience leading organization-level risk management and security programs such as secure SDLC, AI SDLC, and vulnerability management.
- Strong hands-on familiarity with containers, Kubernetes, public cloud environments, and associated security controls.
- Experience with security compliance frameworks including SOC 2, ISO 27001, and SLSA, and with translating controls into engineering work.
- Ability to automate security workflows using at least one language such as Go, Python, or Shell and integrate them into engineering delivery workflows.
- Proven ability to influence senior stakeholders and drive cross-team alignment in a remote-first environment.
- Background in software supply-chain security, including SBOMs, SLSA, provenance, signing, or build-system hardening, is preferred.
- Experience with red-teaming or offensive security, open-source development in security-sensitive projects, public speaking or security writing, industry communities, standards, or early-stage and high-growth companies is preferred.
Benefits
- Remote-first work with team meetups, bi-annual destination summits, and a monthly coworking, phone, and internet stipend.
- Stock options upon hire and promotion, participation in secondary offerings, and 10 years to exercise options.
- 100% company-paid health, vision, and dental insurance premiums for employees and dependents.
- Flexible time off.
- Paid parental leave of 18 weeks for birthing parents and 12 weeks for non-birthing parents, usable all at once or during the child’s first year.
Tech Stack
Categories
About Chainguard
Chainguard provides secure, hardened container images and production-ready builds of open source software for enterprises and developers, typically sold via subscriptions and support. Its offerings include Chainguard Images and tools for software supply chain security; the company also maintains Wolfi, a container-focused Linux distribution. Founded in 2021 and headquartered in Kirkland, WA, Chainguard’s customers include organizations such as OpenAI, Snowflake, and Hewlett Packard Enterprise.