Senior Product Security Engineer

Stack

Responsibilities

• ▹Design, build, and maintain secure CI/CD pipelines with security gates that catch issues before they reach production
• ▹Implement and enforce software supply chain security controls: signed artifacts, SBOMs, provenance attestation (SLSA, Sigstore/Cosign)
• ▹Lead security architecture reviews and threat models for Kubernetes-based workloads running on GCP and AWS
• ▹Harden container images, Kubernetes cluster configurations, and cloud IAM postures, minimizing attack surface
• ▹Define and drive adoption of baseline security standards: pod security standards, network policies, workload identity, secrets management
• ▹Evaluate and operationalize CNAPP/CSPM tooling for continuous cloud-native risk visibility

Requirements

• ▹5+ years in software engineering, security engineering, or a combined role with meaningful hands-on security responsibility
• ▹Strong proficiency in Go or Python, able to write, review, and debug production-quality code
• ▹Deep, hands-on experience with Kubernetes in production (cluster hardening, RBAC, network policies, admission controllers)
• ▹Practical expertise with GCP and/or AWS: IAM, workload identity, secrets management, security services
• ▹Proven track record designing and securing CI/CD pipelines (GitHub Actions, Cloud Build, Tekton, or similar)
• ▹Fluency with container security and software supply chain security tooling/frameworks (Sigstore, SLSA, SBOM)

Nice to have

• ▹Familiarity with Chainguard Images or other minimal/hardened container base image ecosystems
• ▹Experience with policy-as-code tools (OPA, Kyverno, Conftest)
• ▹Contributions to open source security projects
• ▹Background in security research or offensive security (bug bounty, CTF, penetration testing)

Soft skills

What we offer

• ▹Flexible, remote-first culture with team meetups and coworking stipend
• ▹Stock options on hire and promotion, with a 10-year exercise window
• ▹100% covered health, vision, and dental insurance
• ▹Unlimited flexible time off
• ▹18 weeks paid parental leave (12 weeks for non-birthing parents)

About the company

Chainguard is the trusted source for open source, delivering hardened, secure, production-ready builds of the open source software that engineers and AI agents rely on. Its customers include Fortune 500 enterprises and industry leaders such as Anduril, Canva, Fortinet, HPE, OpenAI, Snap, and Snowflake, and it is backed by leading investors including Sequoia Capital and Kleiner Perkins.