Principal Product Security Engineer - Chainguard

At Chainguard, our security posture is our competitive advantage. In this principal-level role, you will:

• Set product security direction across major products and platforms.
• Lead multi-quarter, cross-functional security initiatives that materially reduce risk.
• Embed security by design into roadmaps and day-to-day engineering work.

You’ll operate with high autonomy, working directly with engineering and product leadership to turn high-level risk into concrete, shippable plans.

What you’ll do

• Shape product security strategy: Define and evolve security guardrails for AI-assisted development from design and coding through testing, review, deployment and operations so teams can move quickly while using AI responsibly.
• Lead large-scale security initiatives: Own cross-functional programs (e.g., secure SDLC improvements, vulnerability reduction) that span multiple teams and quarters.
• Accelerate vulnerability remediation and automation: Partner with engineering to build automation for vulnerability detection, triage, and remediation (including STIGs/CIS baselines and policy-as-code), shortening time-to-fix for critical issues.
• Evolve security assurance programs: Improve how we run and consume pentests, vulnerability assessments, bug bounty programs, and red-team activity so findings become lasting engineering and process changes.
• Champion secure-by-default tooling: Guide adoption and integration of security tools (static/dynamic analysis, dependency and license checks, IaC scanners) into CI/CD in a way that works with, not against, developer workflows.
• Support compliance in sensible ways: Help maintain and use frameworks like SOC 2, ISO 27001, NIST, and NIS2 to drive automation-friendly, durable controls into our products and platforms.
• Influence senior leaders and mentor others: Bring clear risk framing and trade-off options to engineering and product leaders; mentor Product Security Engineers and raise the bar across the org.
• Track and translate the threat landscape: Stay current on emerging threats and supply-chain risks, and turn them into concrete changes to our controls, tooling, and product direction.

What we’re looking for

Core experience

• 10+ years in software, product, or application security, with ownership of complex products or platforms.
• Deep expertise in secure architecture and system design for cloud-native or distributed systems, including modern authz/authn and defense-in-depth patterns.
• Experience driving org-level risk management and security programs (secure SDLC, AI SDLC, vulnerability management) from design through rollout.
• Strong hands-on familiarity with cloud-native environments (containers, Kubernetes, public cloud) and associated security controls.
• Experience with security compliance frameworks (e.g., SOC 2, ISO 27001, SLSA) and translating controls into practical engineering work.
• Ability to automate security workflows in at least one language (e.g., Go, Python, Shell) and integrate them into CI/CD.
• Proven ability to influence senior stakeholders and drive alignment across teams through clear, concise communication in a remote-first environment.
• High bar for ownership, accountability, and adaptability — you anticipate risks, navigate ambiguity, and leave systems and teams better than you found them.

Nice to haves

• Background in software supply chain security (SBOMs, SLSA, provenance, signing, build system hardening).
• Experience with red-teaming or offensive security and/or open source software development in security-sensitive projects.
• Public speaking or writing on security topics; participation in industry communities or standards.
• Prior experience in early-stage or high-growth companies, where security must move at product speed.

About Us

We live and breathe our company values:

• We are customer obsessed — We focus on delivering solutions to our customers that create value and make their lives better.
• We have a bias for intentional action — We prioritize, plan, try things, and fail fast.
• We don't take ourselves too seriously (but we do serious work) — We are solving an important problem which takes focus, but we also like to enjoy the journey.
• We trust each other and assume good intentions — We're transparent with decisions to empower team members to make well-informed decisions.