Staff Product Security Engineer

🔥 13 hours ago

🇺🇸 United States – Remote

💵 $205k - $231k / year

⏰ Full Time

🔴 Lead

👮‍♂️ Cybersecurity / Security Engineer

🦅 H1B Visa Sponsor

This company has sponsored H1B visas in the past.

👻 Ghost score 20%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Chainguard

WebsiteLinkedInAll Job Openings

51 - 200 employees

Founded 2021

🔐 Security

☁️ SaaS

🔒 Cybersecurity

Security • SaaS • Cybersecurity

Chainguard is a company that specializes in building secure container images to enhance software security and compliance. Their products include low-to-zero CVE container images, which are updated daily to maintain security and compliance standards such as FedRAMP, NIST 800-53, PCI-DSS, SOC2, and CIS benchmarks. Chainguard focuses on reducing vulnerabilities, automating compliance, and supporting development workflows without compromising on innovation and productivity. The company serves a wide range of industries, including highly regulated sectors, by providing hardened image solutions to mitigate software supply chain risks and enhance application security.

📋 Description

• Drive product security strategy and execution across multiple products, platforms, and engineering teams • Lead the evolution of Chainguard’s secure SDLC, with emphasis on the AI SDLC and AI-assisted development risks • Define and implement guardrails for responsible AI use in engineering • Partner with Engineering to embed security controls across architecture, design, coding, testing, code review, deployment, and operations • Lead secure architecture reviews and threat-modeling efforts • Own vulnerability reduction, security automation, and secure-by-default engineering initiatives • Automate vulnerability detection, triage, and remediation, including policy-as-code and cloud or container security controls • Champion security tooling such as static and dynamic analysis, dependency and license checks, IaC scanners, and AI-related controls in developer workflows and CI/CD • Improve security assurance activities including penetration tests, vulnerability assessments, bug bounty programs, and red-team exercises • Translate SOC 2, ISO 27001, NIST, and SLSA into durable engineering controls • Monitor emerging threats, software supply-chain risks, and AI security developments • Influence senior stakeholders through risk framing, trade-off analysis, and recommendations • Mentor Product Security Engineers and raise security maturity across the engineering organization

🎯 Requirements

• 7+ years of experience in software, product, application, or cloud security • Experience driving security programs from design through rollout, such as secure SDLC, AI SDLC, vulnerability management, platform hardening, or security automation • Practical understanding of how engineers build and ship software • Ability to translate security requirements into workflows teams will adopt • Strong hands-on familiarity with containers, Kubernetes, public cloud, and associated security controls • Experience with SOC 2, ISO 27001, NIST, or SLSA • Ability to automate security workflows in Go, Python, or Shell and integrate them into CI/CD • Ability to influence and align teams through clear, concise communication in a remote-first environment • Strong ownership, accountability, and adaptability • Experience designing or operating an AI SDLC, AI security program, or governance model for AI-assisted development is preferred • Background in software supply-chain security, including SBOMs, provenance, signing, or build-system hardening is preferred • Experience with red-teaming, offensive security, or security-sensitive open-source software development is preferred • Experience with SAST, DAST, SCA, IaC scanning, policy-as-code, or related security tooling is preferred • Public speaking or writing on security topics, or participation in industry communities and standards bodies is preferred • Experience in an early-stage or high-growth company is preferred

🏖️ Benefits

• Work remotely with team meetup opportunities • Bi-annual destination summits • Monthly stipend for coworking spaces, phone and internet costs • Stock options upon hire and promotion • Participation in secondary offerings • 10 years to exercise stock options • 100% covered health, vision and dental insurance premiums for employee and dependents • Flexible time off • 18 weeks paid parental leave for birthing parents • 12 weeks paid parental leave for non-birthing parents • Equal opportunity employment