C
Principal Product Security Engineer
Contract type
Ongoing
Work mode
Remote
Experience
Lead / principal · 10+ years
Job description
Principal Product Security Engineer at Chainguard responsible for setting product security direction, leading cross-functional security initiatives, and embedding security by design into engineering and product roadmaps.
At a glance
- Work mode
- Remote
What you'll do
- Define and evolve security guardrails for AI-assisted development from design and coding through testing, review, deployment and operations
- Own cross-functional programs (e.g., secure SDLC improvements, vulnerability reduction) that span multiple teams and quarters
- Partner with engineering to build automation for vulnerability detection, triage, and remediation (including STIGs/CIS baselines and policy-as-code)
- Improve how pentests, vulnerability assessments, bug bounty programs, and red-team activity are run and consumed so findings become lasting engineering and process changes
- Guide adoption and integration of security tools (static/dynamic analysis, dependency and license checks, IaC scanners) into CI/CD
- Help maintain and use frameworks like SOC 2, ISO 27001, NIST, and NIS2 to drive automation-friendly, durable controls into products and platforms
- Bring clear risk framing and trade-off options to engineering and product leaders; mentor Product Security Engineers
- Stay current on emerging threats and supply-chain risks, and turn them into concrete changes to controls, tooling, and product direction
What we're looking for
- 10+ years in software, product, or application security, with ownership of complex products or platforms
- Deep expertise in secure architecture and system design for cloud-native or distributed systems, including modern authz/authn and defense-in-depth patterns
- Experience driving org-level risk management and security programs (secure SDLC, AI SDLC, vulnerability management) from design through rollout
- Strong hands-on familiarity with cloud-native environments (containers, Kubernetes, public cloud) and associated security controls
- Experience with security compliance frameworks (e.g., SOC 2, ISO 27001, SLSA) and translating controls into practical engineering work
- Ability to automate security workflows in at least one language (e.g., Go, Python, Shell) and integrate them into CI/CD
- Proven ability to influence senior stakeholders and drive alignment across teams through clear, concise communication in a remote-first environment
- High bar for ownership, accountability, and adaptability
Nice to have
- Background in software supply chain security (SBOMs, SLSA, provenance, signing, build system hardening)
- Experience with red-teaming or offensive security and/or open source software development in security-sensitive projects
- Public speaking or writing on security topics; participation in industry communities or standards
- Prior experience in early-stage or high-growth companies, where security must move at product speed
Benefits
Flexible & Remote-First Culture: work remotely with team meetup opportunities, bi-annual destination summits, and a monthly stipend for coworking spaces, phone and internet costs
18 weeks paid parental leave for birthing parents and 12 weeks for non-birthing parents, with the option to use it all at once or throughout your child's first year
- Stock options upon hire and promotion; can participate in secondary offerings and have 10 years to exercise options
- 100% covered health, vision and dental insurance premiums for you and your dependents
- Flexible time off
Apply
About Chainguard
The trusted source for open source
Chainguard delivers hardened, secure, and production-ready builds of all the open source software engineers and AI agents rely on, helping organizations build faster, stay compliant, and eliminate risk.
Key facts
- Customers include Fortune 500 enterprises and global industry leaders
- Venture-backed by leading investors
Partners & customers
AndurilCanvaFortinetHewlett Packard EnterpriseOpenAISnap Inc.SnowflakeAmplifyIVPKleiner PerkinsLightspeed Venture PartnersMantis VCRedpoint VenturesSequoia CapitalSpark Capital
What they value
- We are customer obsessed
- We have a bias for intentional action
- We don't take ourselves too seriously (but we do serious work)
- We trust each other and assume good intentions