Staff Product Security Engineer

This is a fully remote position, open to applicants in United States.

📋 Description

• Design, construct, and uphold secure CI/CD pipelines that incorporate security gates to detect issues prior to production.

• Systematically, consistently, and automatically assess the risk exposure of Chainguard products.

• Implement and enforce security controls for the software supply chain, including signed artifacts, SBOMs, and provenance attestation using SLSA, Sigstore, or Cosign.

• Proactively recognize emerging security needs of customers and develop solutions to address them.

• Lead security architecture evaluations and threat modeling for Kubernetes workloads on GCP and AWS.

• Strengthen container images, Kubernetes cluster configurations, and cloud IAM postures to reduce the attack surface.

• Define and promote the adoption of baseline security standards, including pod security standards, network policies, workload identity, and secrets management.

⛳️ Requirements

• Over 8 years of experience in software engineering, security engineering, or a hybrid role that includes significant hands-on security responsibilities.

• Strong expertise in Go or Python, with the capability to write, review, and debug production-quality code.

• Extensive hands-on experience with Kubernetes in a production environment, encompassing cluster hardening, RBAC, network policies, and admission controllers.

• Practical knowledge of GCP and/or AWS, including IAM, workload identity, secrets management, and security services.

• A proven history of designing and securing CI/CD pipelines, such as GitHub Actions, Cloud Build, or Tekton.

• Proficiency in container security, including image scanning, distroless/minimal base images, and runtime security.

• Experience with software supply chain security tools and frameworks, including Sigstore, SLSA, and SBOM generation.

• A solid grasp of OWASP, NIST, and cloud security frameworks and their practical application.

• Familiarity with Chainguard Images or other minimal/hardened container base image ecosystems.

• Experience with policy-as-code tools like OPA, Kyverno, or Conftest.

• Contributions to open-source security initiatives.

• A background in security research or offensive security, including bug bounty, CTF, or penetration testing.

🏝️ Benefits

• Opportunity to work remotely with options for team meetups.

• Bi-annual destination summits.

• Monthly stipend for coworking spaces, phone, and internet expenses.

• Stock options upon hiring and promotion.

• Participation in secondary offerings.

• 10 years available to exercise stock options.

• 100% coverage of health, vision, and dental insurance premiums for employees and their dependents.

• Flexible time off policy.

• 18 weeks of paid parental leave for birthing parents.

• 12 weeks of paid parental leave for non-birthing parents.