Principal Product Security Engineer

🔥 13 hours ago

🌐 United States, Canada, +1 more countries – Remote

🇺🇸 United States – Remote 🇨🇦 Canada – Remote 🇬🇧 United Kingdom – Remote

💵 $229k - $258k / year

⏰ Full Time

🔴 Lead

👮‍♂️ Cybersecurity / Security Engineer

🦅 H1B Visa Sponsor

This company has sponsored H1B visas in the past.

👻 Ghost score 20%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Chainguard

WebsiteLinkedInAll Job Openings

51 - 200 employees

Founded 2021

🔐 Security

☁️ SaaS

🔒 Cybersecurity

Security • SaaS • Cybersecurity

Chainguard is a company that specializes in building secure container images to enhance software security and compliance. Their products include low-to-zero CVE container images, which are updated daily to maintain security and compliance standards such as FedRAMP, NIST 800-53, PCI-DSS, SOC2, and CIS benchmarks. Chainguard focuses on reducing vulnerabilities, automating compliance, and supporting development workflows without compromising on innovation and productivity. The company serves a wide range of industries, including highly regulated sectors, by providing hardened image solutions to mitigate software supply chain risks and enhance application security.

📋 Description

• Set product security direction across major products and platforms • Lead multi-quarter, cross-functional security initiatives that materially reduce risk • Embed security by design into roadmaps and day-to-day engineering work • Define and evolve security guardrails for AI-assisted development across design, coding, testing, review, deployment, and operations • Own cross-functional secure SDLC and vulnerability reduction programs spanning multiple teams and quarters • Build automation for vulnerability detection, triage, and remediation, including STIGs/CIS baselines and policy-as-code • Improve pentest, vulnerability assessment, bug bounty, and red-team programs • Guide integration of static/dynamic analysis, dependency and license checks, and IaC scanners into CI/CD • Support SOC 2, ISO 27001, NIST, and NIS2 compliance through durable, automation-friendly controls • Advise engineering and product leaders on risk framing and trade-offs • Mentor Product Security Engineers • Track emerging threats and supply-chain risks and translate them into changes to controls, tooling, and product direction • Work directly with engineering and product leadership with high autonomy

🎯 Requirements

• 10+ years in software, product, or application security, with ownership of complex products or platforms • Deep expertise in secure architecture and system design for cloud-native or distributed systems • Knowledge of modern authorization/authentication and defense-in-depth patterns • Experience driving organization-level risk management and security programs, including secure SDLC, AI SDLC, and vulnerability management • Hands-on familiarity with containers, Kubernetes, public cloud, and associated security controls • Experience with SOC 2, ISO 27001, and SLSA compliance frameworks • Ability to automate security workflows in Go, Python, Shell, or another language and integrate them into CI/CD • Ability to influence senior stakeholders and drive cross-team alignment through clear, concise communication in a remote-first environment • Ownership, accountability, and adaptability • Software supply chain security experience, including SBOMs, SLSA, provenance, signing, and build system hardening (nice to have) • Red-teaming or offensive security experience and/or open source software development in security-sensitive projects (nice to have) • Public speaking or writing on security topics and participation in industry communities or standards (nice to have) • Prior experience in early-stage or high-growth companies (nice to have)

🏖️ Benefits

• Work remotely with team meetup opportunities • Bi-annual destination summits • Monthly stipend for coworking spaces, phone and internet costs • Stock options upon hire and promotion • Participation in secondary offerings • 10 years to exercise stock options • 100% covered health, vision and dental insurance premiums for employee and dependents • Flexible time off • 18 weeks paid parental leave for birthing parents • 12 weeks paid parental leave for non-birthing parents • Equal opportunity employer