Principal Product Security Engineer
Chainguard4 hours ago
Remote, CanadaStaff+
Responsibilities
- Set product security strategy and security guardrails for AI-assisted development across design, coding, testing, review, deployment, and operations.
- Lead multi-quarter, cross-functional security initiatives including secure SDLC improvements and vulnerability reduction.
- Build and automate vulnerability detection, triage, and remediation workflows, including STIGs, CIS baselines, and policy-as-code.
- Improve pentest, vulnerability assessment, bug bounty, and red-team programs so findings drive lasting changes.
- Guide integration of static and dynamic analysis, dependency and license checks, and IaC scanners into CI/CD.
- Apply SOC 2, ISO 27001, NIST, and NIS2 controls to products and platforms.
- Track emerging threats and software supply-chain risks, influence senior leaders, and mentor Product Security Engineers.
Requirements
- 10+ years of experience in software, product, or application security with ownership of complex products or platforms.
- Deep expertise in secure architecture and system design for cloud-native or distributed systems, including authentication, authorization, and defense-in-depth patterns.
- Experience leading organization-level risk management and security programs such as secure SDLC, AI SDLC, and vulnerability management.
- Hands-on familiarity with containers, Kubernetes, public cloud, and related security controls.
- Experience with SOC 2, ISO 27001, SLSA, and translating compliance controls into practical engineering work.
- Ability to automate security workflows using at least one of Go, Python, or Shell and integrate them into CI/CD.
- Ability to influence senior stakeholders and align teams in a remote-first environment.
- Preferred experience includes software supply-chain security, SBOMs, provenance, signing, build-system hardening, red-teaming, offensive security, open-source security projects, public speaking or writing on security topics, and early-stage or high-growth companies.
Benefits
- Remote-first work with team meetups, bi-annual destination summits, and a monthly coworking, phone, and internet stipend.
- Stock options upon hire and promotion, participation in secondary offerings, and a 10-year exercise window.
- 100% company-paid health, vision, and dental insurance premiums for employees and dependents.
- Flexible time off.
- Paid parental leave of 18 weeks for birthing parents and 12 weeks for non-birthing parents, usable at once or throughout the child’s first year.
Tech Stack
Categories
About Chainguard
Chainguard provides secure, hardened container images and production-ready builds of open source software for enterprises and developers, typically sold via subscriptions and support. Its offerings include Chainguard Images and tools for software supply chain security; the company also maintains Wolfi, a container-focused Linux distribution. Founded in 2021 and headquartered in Kirkland, WA, Chainguard’s customers include organizations such as OpenAI, Snowflake, and Hewlett Packard Enterprise.