Principal Product Security Engineer

About the role

<div class="content-intro"><p>Chainguard is the trusted source for open source. By delivering hardened, secure, and production-ready builds of all the open source software engineers and AI agents rely on, Chainguard helps organizations build faster, stay compliant, and eliminate risk.&nbsp;<br><br>Our customers include Fortune 500 enterprises and global industry leaders, including Anduril, Canva, Fortinet, Hewlett Packard Enterprise, OpenAI, Snap Inc., and Snowflake. <br><br>Chainguard is venture-backed by leading investors, including Amplify, IVP, Kleiner Perkins, Lightspeed Venture Partners, Mantis VC, Redpoint Ventures, Sequoia Capital, and Spark Capital.</p></div><p><strong>Principal Product Security Engineer</strong></p> <p><strong>The role, in a nutshell</strong></p> <p>At Chainguard, our security posture is our competitive advantage. In this principal‑level role, you will:</p> <ul> <li>Set product security direction across major products and platforms.</li> <li>Lead multi‑quarter, cross‑functional security initiatives that materially reduce risk.</li> <li>Embed security by design into roadmaps and day‑to‑day engineering work.</li> </ul> <p>You’ll operate with high autonomy, working directly with engineering and product leadership to turn high‑level risk into concrete, shippable plans.</p> <p><strong>What you’ll do</strong></p> <ul> <li><strong>Shape product security strategy</strong><strong><br></strong>Define and evolve security guardrails for AI-assisted development from design and coding through testing, review, deployment and operations so teams can move quickly while using AI responsibly.</li> <li><strong>Lead large‑scale security initiatives</strong><strong><br></strong>Own cross‑functional programs (e.g., secure SDLC improvements, vulnerability reduction) that span multiple teams and quarters.</li> <li><strong>Accelerate vulnerability remediation and automation</strong><strong><br></strong>Partner with engineering to build automation for vulnerability detection, triage, and remediation (including STIGs/CIS baselines and policy‑as‑code), shortening time‑to‑fix for critical issues.</li> <li><strong>Evolve security assurance programs</strong><strong><br></strong>Improve how we run and consume pentests, vulnerability assessments, bug bounty programs, and red‑team activity so findings become lasting engineering and process changes.</li> <li><strong>Champion secure‑by‑default tooling</strong><strong><br></strong>Guide adoption and integration of security tools (static/dynamic analysis, dependency and license checks, IaC scanners) into CI/CD in a way that works with, not against, developer workflows.</li> <li><strong>Support compliance in sensible ways</strong><strong><br></strong>Help maintain and use frameworks like SOC 2, ISO 27001, NIST, and NIS2 to drive automation‑friendly, durable controls into our products and platforms.</li> <li><strong>Influence senior leaders and mentor others</strong><strong><br></strong>Bring clear risk framing and trade‑off options to engineering and product leaders; mentor Product Security Engineers and raise the bar across the org.<br><strong>Track and translate the threat landscape</strong><strong><br></strong>Stay current on emerging threats and supply‑chain risks, and turn them into concrete changes to our controls, tooling, and product direction.<br><br></li> </ul> <p><strong>What we’re looking for</strong></p> <p><strong>Core experience</strong></p> <ul> <li>10+ years in software, product, or application security, with ownership of complex products or platforms.</li> <li>Deep expertise in secure architecture and system design for cloud‑native or distributed systems, including modern authz/authn and defense‑in‑depth patterns.</li> <li>Experience driving org‑level risk management and security programs (secure SDLC, AI SDLC, vulnerability management) from design through rollout.</li> <li>Strong hands‑on familiarity with cloud‑native environments (containers, Kubernetes, public cloud) a

Skills