Principal Product Security Engineer

🔥 12 hours ago

🇬🇧 United Kingdom – Remote

⏰ Full Time

🔴 Lead

👮‍♂️ Cybersecurity / Security Engineer

👻 Ghost score 25%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Chainguard

WebsiteLinkedInAll Job Openings

51 - 200 employees

Founded 2021

🔐 Security

☁️ SaaS

🔒 Cybersecurity

Security • SaaS • Cybersecurity

Chainguard is a company that specializes in building secure container images to enhance software security and compliance. Their products include low-to-zero CVE container images, which are updated daily to maintain security and compliance standards such as FedRAMP, NIST 800-53, PCI-DSS, SOC2, and CIS benchmarks. Chainguard focuses on reducing vulnerabilities, automating compliance, and supporting development workflows without compromising on innovation and productivity. The company serves a wide range of industries, including highly regulated sectors, by providing hardened image solutions to mitigate software supply chain risks and enhance application security.

📋 Description

• Set product security direction across major products and platforms. • Lead multi-quarter, cross-functional security initiatives that materially reduce risk. • Embed security by design into roadmaps and day-to-day engineering work. • Define and evolve security guardrails for AI-assisted development across design, coding, testing, review, deployment, and operations. • Own cross-functional programs such as secure SDLC improvements and vulnerability reduction. • Partner with engineering to build automation for vulnerability detection, triage, and remediation, including STIGs/CIS baselines and policy-as-code. • Improve the use of penetration tests, vulnerability assessments, bug bounty programs, and red-team activity so findings lead to lasting engineering and process changes. • Guide adoption and integration of static/dynamic analysis, dependency and license checks, and IaC scanners into CI/CD. • Help maintain and use SOC 2, ISO 27001, NIST, and NIS2 frameworks to drive durable controls. • Bring risk framing and trade-off options to engineering and product leaders. • Mentor Product Security Engineers and raise the security bar across the organization. • Track emerging threats and supply-chain risks and translate them into changes to controls, tooling, and product direction.

🎯 Requirements

• 10+ years in software, product, or application security, with ownership of complex products or platforms. • Deep expertise in secure architecture and system design for cloud-native or distributed systems. • Knowledge of modern authorization/authentication and defense-in-depth patterns. • Experience driving organization-level risk management and security programs, including secure SDLC, AI SDLC, and vulnerability management, from design through rollout. • Strong hands-on familiarity with containers, Kubernetes, public cloud, and associated security controls. • Experience with security compliance frameworks such as SOC 2, ISO 27001, and SLSA. • Ability to automate security workflows in at least one language, such as Go, Python, or Shell, and integrate them into CI/CD. • Proven ability to influence senior stakeholders and drive alignment across teams through clear, concise communication in a remote-first environment. • High ownership, accountability, and adaptability. • Background in software supply chain security, including SBOMs, SLSA, provenance, signing, and build system hardening is nice to have. • Experience with red-teaming or offensive security and/or open source software development in security-sensitive projects is nice to have. • Public speaking or writing on security topics and participation in industry communities or standards is nice to have. • Prior experience in early-stage or high-growth companies is nice to have.

🏖️ Benefits

• Flexible & Remote-First Culture: Work remotely with team meetup opportunities, bi-annual destination summits, and a monthly stipend for coworking spaces, phone and internet costs. • Receive stock options upon hire and promotion. • Participate in secondary offerings. • 10 years to exercise stock options. • 100% covered health, vision and dental insurance premiums for the employee and dependents. • Unlimited flexible time off. • 18 weeks paid parental leave for birthing parents and 12 weeks for non-birthing parents, usable all at once or throughout the child's first year. • Team meetup opportunities. • Bi-annual destination summits. • Monthly stipend for coworking spaces, phone and internet costs.