Principal Product Security Engineer

Chainguard

4d • $229,000 - $258,000 • Remote

About The Position

Chainguard is hiring a Principal Product Security Engineer to set product security direction across major products and platforms, lead cross-functional security initiatives, and embed security by design into roadmaps and engineering work. The role operates with high autonomy and partners directly with engineering and product leadership to turn risk into concrete, shippable plans.

The engineer will shape security strategy for AI-assisted development; lead initiatives such as secure SDLC improvements and vulnerability reduction; accelerate vulnerability detection, triage, and remediation; evolve pentest, vulnerability assessment, bug bounty, and red-team programs; guide adoption of security tooling in CI/CD; and support practical compliance controls. The role also influences senior leaders, mentors Product Security Engineers, and translates emerging threats and supply-chain risks into improvements to controls, tooling, and product direction.

This is a remote role open to candidates in the United States, Canada, and the United Kingdom. Chainguard describes its culture as remote-first and offers flexible time off, stock options, and specified insurance and parental-leave benefits.

Requirements

• 10 or more years of experience in software, product, or application security, with ownership of complex products or platforms.
• Deep expertise in secure architecture and system design for cloud-native or distributed systems, including modern authentication and authorization and defense-in-depth patterns.
• Experience driving organization-level risk management and security programs, including secure SDLC, AI SDLC, and vulnerability management, from design through rollout.
• Strong hands-on familiarity with cloud-native environments, including containers, Kubernetes, public cloud, and associated security controls.
• Experience with security compliance frameworks such as SOC 2, ISO 27001, or SLSA, and translating controls into practical engineering work.
• Ability to automate security workflows in at least one language, such as Go, Python, or Shell, and integrate them into CI/CD.
• Proven ability to influence senior stakeholders and align teams through clear, concise communication in a remote-first environment.
• High ownership, accountability, and adaptability, including the ability to anticipate risks and navigate ambiguity.

Nice To Haves

• Background in software supply-chain security, including SBOMs, SLSA, provenance, signing, or build-system hardening.
• Experience with red-teaming or offensive security, and/or open-source software development in security-sensitive projects.
• Public speaking or writing on security topics, or participation in industry communities or standards.
• Prior experience in early-stage or high-growth companies where security must move at product speed.

Responsibilities

• Define and evolve security guardrails for AI-assisted development across design, coding, testing, review, deployment, and operations.
• Own cross-functional, multi-quarter security programs, such as secure SDLC improvements and vulnerability reduction.
• Partner with engineering to automate vulnerability detection, triage, and remediation, including STIG/CIS baselines and policy-as-code.
• Improve how penetration tests, vulnerability assessments, bug bounty programs, and red-team activities are conducted and used, turning findings into lasting engineering and process changes.
• Guide adoption and CI/CD integration of static and dynamic analysis, dependency and license checks, and infrastructure-as-code scanners.
• Help maintain and apply frameworks such as SOC 2, ISO 27001, NIST, and NIS2 to drive durable, automation-friendly controls.
• Present risk framing and trade-offs to engineering and product leaders, mentor Product Security Engineers, and raise security standards across the organization.
• Monitor emerging threats and software supply-chain risks and translate them into changes to controls, tooling, and product direction.

Benefits

• Flexible, remote-first culture with team meetup opportunities and bi-annual destination summits.
• Monthly stipend for coworking spaces, phone, and internet costs.
• Stock options upon hire and promotion, participation in secondary offerings, and 10 years to exercise options.
• 100% coverage of health, vision, and dental insurance premiums for employees and dependents.
• Flexible time off.
• Paid parental leave: 18 weeks for birthing parents and 12 weeks for non-birthing parents.

What This Job Offers

• Job Type: Full-time
• Career Level: Principal
• Education Level: No Education Listed