Staff Product Security Engineer - Chainguard

About the Role

As a Staff Product Security Engineer at Chainguard, you will be a deeply technical engineer embedded directly into the product development process. You won't just be a gatekeeper; you will be responsible for designing, building, and maintaining secure CI/CD pipelines and hardening our cloud-native infrastructure.

What You’ll Do

Build & Harden Secure Pipelines

• Design and maintain secure CI/CD pipelines with automated security gates.
• Systematically capture and mitigate risk exposure across Chainguard products.
• Implement software supply chain security controls, including signed artifacts, SBOMs, and provenance attestation (SLSA, Sigstore/Cosign).
• Proactively identify and build solutions for emerging customer security needs.

Cloud-Native Product Hardening

• Lead security architecture reviews and threat models for Kubernetes-based workloads on GCP and AWS.
• Harden container images, Kubernetes cluster configurations, and cloud IAM postures to minimize attack surface.
• Define and drive adoption of baseline security standards, including pod security, network policies, and secrets management.

What We’re Looking For

• Experience: 8+ years in software or security engineering with significant hands-on responsibility.
• Languages: Strong proficiency in Go or Python, with the ability to write and debug production-quality code.
• Kubernetes: Deep, hands-on experience with production cluster hardening, RBAC, and admission controllers.
• Cloud Security: Practical expertise with GCP/AWS IAM, workload identity, and security services (e.g., Security Command Center, Security Hub).
• CI/CD: Proven track record securing pipelines (GitHub Actions, Cloud Build, Tekton).
• Container Security: Fluency in image scanning, distroless/minimal base images, and runtime security.
• Supply Chain: Experience with Sigstore, SLSA, and SBOM generation.
• Frameworks: Solid understanding of OWASP, NIST, and cloud security standards.

Benefits

• Flexible & Remote-First Culture: Includes team meetups, bi-annual summits, and a monthly stipend for coworking, phone, and internet.
• Equity: Stock options upon hire and promotion with a 10-year exercise window.
• Health & Wellness: 100% covered health, vision, and dental insurance for you and your dependents.
• Time Off: Unlimited flexible time off to recharge.
• Parental Leave: 18 weeks for birthing parents and 12 weeks for non-birthing parents.