Staff Vulnerability Management Engineer

This is a fully remote position, open to applicants in Canada.

📋 Description

• Take ownership of the measurement, disclosure, and reporting of a pipeline containing thousands of novel vulnerabilities that are identified weekly by frontier models and other sources.

• Fine-tune the response process in reaction to emerging trends.

• Oversee the reporting of newly identified vulnerabilities to upstream projects and maintainers.

• Manage the CNA program to allocate new CVEs when necessary.

• Coordinate internal and external embargoes with customers, internal engineering teams, and external maintainers.

• Collaborate with the Linux Foundation, CISA, and other organizations to coordinate actions and responses.

• Steer industry direction to ensure that Chainguard customer needs are addressed by emerging standards and norms.

• Serve as the outward face of Chainguard’s industry-leading efforts.

• Partner with AI model vendors to influence the future evolution of the software supply chain.

• Provide technical leadership, cross-team influence, and ownership of complex challenges as an individual contributor.

⛳️ Requirements

• Over 7 years of experience in software security, open source maintenance, or vulnerability disclosure management.

• Strong comprehension of responsible disclosure practices.

• Practical knowledge in automating pipelines and processes on a large scale, minimizing the need for human intervention.

• Extensive experience within open source communities.

• Background in coordinating with public sector or industry standards organizations and working groups.

• Established thought leadership in vulnerability disclosure management and embargo (desirable).

• Familiarity with Chainguard Images or minimal/hardened container base image ecosystems (desirable).

• Experience in operating a CNA (desirable).

• Software engineering background in Python, Java, Javascript, Go, or similar languages (desirable).

• Background in security research, penetration testing, or bug bounty programs (desirable).

🏝️ Benefits

• Flexible & Remote-First Culture.

• Opportunities for team meetups.

• Bi-annual destination summits.

• Monthly stipend for coworking spaces, phone, and internet expenses.

• Stock options provided upon hire and promotion.

• Participation in secondary offerings.

• 10 years to exercise stock options.

• 100% coverage of health, vision, and dental insurance premiums for you and your dependents.

• Flexible time off policy.

• 18 weeks of paid parental leave for birthing parents.

• 12 weeks of paid parental leave for non-birthing parents.

• Option to take parental leave all at once or spread it throughout the child's first year.