Staff Product Security Engineer

Chainguard

3d • $205,000 - $231,000 • Remote

About The Position

Chainguard is hiring a deeply technical Staff Product Security Engineer to embed security throughout its software development and product processes. The role focuses on securing software delivery pipelines, systematically capturing product risk, and meeting emerging customer security needs. The engineer will design and maintain CI/CD security gates; implement software supply chain controls such as signed artifacts, SBOMs, and provenance attestations; and lead security architecture reviews and threat modeling for Kubernetes workloads on GCP and AWS. The position also involves hardening container images, Kubernetes configurations, and cloud IAM, and driving adoption of baseline security standards.

Requirements

• At least 8 years of experience in software engineering, security engineering, or a combined role, with meaningful hands-on security responsibility throughout.
• Strong proficiency in Go or Python, including writing, reviewing, and debugging production-quality code.
• Deep, hands-on Kubernetes production experience, including cluster hardening, RBAC, network policies, and admission controllers.
• Practical expertise with GCP and/or AWS, including IAM, workload identity, secrets management, and security services such as GCP Security Command Center or AWS Security Hub.
• A proven track record designing and securing CI/CD pipelines using GitHub Actions, Cloud Build, Tekton, or similar tools.
• Fluency with container security, including image scanning, distroless or minimal base images, and runtime security.
• Experience with software supply chain security tooling and frameworks, including Sigstore, SLSA, and SBOM generation.
• Solid understanding of OWASP, NIST, and cloud security frameworks, and the ability to apply them pragmatically.

Nice To Haves

• Familiarity with Chainguard Images or other minimal or hardened container base image ecosystems.
• Experience with policy-as-code tools such as OPA, Kyverno, or Conftest.
• Contributions to open source security projects.
• Background in security research or offensive security, such as bug bounty, CTF, or penetration testing.

Responsibilities

• Design, build, and maintain secure CI/CD pipelines with security gates that identify issues before production.
• Systematically and automatically capture the risk exposure of Chainguard products.
• Implement and enforce software supply chain security controls, including signed artifacts, SBOMs, and provenance attestations using SLSA and Sigstore/Cosign.
• Identify emerging customer security needs and build solutions to address them.
• Lead security architecture reviews and threat models for Kubernetes-based workloads running on GCP and AWS.
• Harden container images, Kubernetes cluster configurations, and cloud IAM postures to minimize attack surface.
• Define and drive adoption of baseline security standards, including pod security standards, network policies, workload identity, and secrets management.

Benefits

• Remote-first culture with team meetup opportunities and bi-annual destination summits.
• Monthly stipend for coworking spaces, phone, and internet costs.
• Stock options upon hire and promotion, participation in secondary offerings, and 10 years to exercise options.
• 100% coverage of health, vision, and dental insurance premiums for employees and dependents.
• Flexible time off.
• Paid parental leave: 18 weeks for birthing parents and 12 weeks for non-birthing parents.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed