Staff Product Security Engineer

Chainguard is the trusted source for open source. The Staff Product Security Engineer will design, build, and maintain secure CI/CD pipelines, harden container images and Kubernetes cluster configurations, and lead security architecture reviews. The role is individual-contributor and requires 7+ years of software engineering or security engineering experience, proficiency in Go or Python, and hands-on experience with Kubernetes and cloud providers.

Requirements

• 7+ years in software engineering, security engineering, or a combined role with meaningful hands-on security responsibility throughout.
• Strong proficiency in Go or Python, with the ability to write, review, and debug production-quality code.
• Deep, hands-on experience with Kubernetes in production (cluster hardening, RBAC, network policies, admission controllers).
• Practical expertise with GCP and/or AWS: IAM, workload identity, secrets management, security services (e.g., GCP Security Command Center, AWS Security Hub).
• Proven track record designing and securing CI/CD pipelines (GitHub Actions, Cloud Build, Tekton, or similar).
• Fluency with container security: image scanning, distroless/minimal base images, runtime security.
• Experience with software supply chain security tooling and frameworks (Sigstore, SLSA, SBOM generation).
• Solid understanding of OWASP, NIST, and cloud security frameworks and how to apply them pragmatically.

Benefits

• Flexible & Remote-First Culture
• 100% Covered Health Insurance
• ∞ Flexible Time Off
• 18 Weeks Paid Parental Leave