Staff Product Security Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Lead the development and execution of product security strategies across various products, platforms, and engineering teams.

• Drive the advancement of Chainguard’s secure Software Development Life Cycle (SDLC), focusing on AI SDLC and associated risks with AI-assisted development.

• Establish and enforce guidelines for the ethical use of AI within engineering practices.

• Collaborate with the Engineering team to integrate security measures throughout architecture, design, coding, testing, code reviews, deployment, and operational processes.

• Conduct secure architecture evaluations and lead threat modeling initiatives.

• Oversee initiatives aimed at reducing vulnerabilities, automating security, and implementing secure-by-default engineering practices.

• Automate the processes of vulnerability detection, triage, and remediation, including policy-as-code and security controls for cloud or container environments.

• Advocate for security tools such as static and dynamic analysis, dependency and license checks, Infrastructure as Code (IaC) scanners, and AI-related controls within developer workflows and CI/CD pipelines.

• Enhance security assurance efforts including penetration testing, vulnerability assessments, bug bounty programs, and red-team exercises.

• Convert SOC 2, ISO 27001, NIST, and SLSA requirements into robust engineering controls.

• Stay informed on emerging threats, software supply chain vulnerabilities, and advancements in AI security.

• Persuade senior stakeholders through risk assessment, trade-off analysis, and strategic recommendations.

• Mentor Product Security Engineers and enhance security maturity within the engineering organization.

⛳️ Requirements

• Over 7 years of experience in software, product, application, or cloud security.

• Proven track record in leading security programs from design through implementation, including secure SDLC, AI SDLC, vulnerability management, platform hardening, or security automation.

• Solid understanding of how engineers develop and deploy software.

• Capability to translate security needs into workflows that teams will embrace.

• Strong hands-on experience with containers, Kubernetes, public cloud environments, and related security controls.

• Familiarity with SOC 2, ISO 27001, NIST, or SLSA frameworks.

• Proficient in automating security workflows using Go, Python, or Shell, and integrating these into CI/CD processes.

• Ability to influence and unite teams through effective communication in a remote-first setting.

• Demonstrated ownership, accountability, and adaptability.

• Preferred experience in designing or managing an AI SDLC, AI security program, or governance framework for AI-assisted development.

• Background in software supply chain security, including Software Bill of Materials (SBOMs), provenance, signing, or build-system hardening is preferred.

• Experience in red teaming, offensive security, or developing security-sensitive open-source software is preferred.

• Familiarity with SAST, DAST, SCA, IaC scanning, policy-as-code, or similar security tools is preferred.

• Experience with public speaking or writing on security topics, or active participation in industry communities and standards organizations is preferred.

• Background in an early-stage or high-growth company is preferred.

🏝️ Benefits

• Remote work with opportunities for team meetups.

• Bi-annual destination summits.

• Monthly stipend for coworking spaces, as well as phone and internet expenses.

• Stock options available upon hiring and promotion.

• Participation in secondary stock offerings.

• A decade to exercise stock options.

• Comprehensive health, vision, and dental insurance premiums fully covered for employees and their dependents.

• Flexible time off policy.

• 18 weeks of paid parental leave for birthing parents.

• 12 weeks of paid parental leave for non-birthing parents.

• Commitment to equal opportunity employment.