Principal Product Security Engineer

<div class="content-intro"><p>Chainguard is the trusted source for open source. By delivering hardened, secure, and production-ready builds of all the open source software engineers and AI agents rely on, Chainguard helps organizations build faster, stay compliant, and eliminate risk. <br><br>Our customers include Fortune 500 enterprises and global industry leaders, including Anduril, Canva, Fortinet, Hewlett Packard Enterprise, OpenAI, Snap Inc., and Snowflake. <br><br>Chainguard is venture-backed by leading investors, including Amplify, IVP, Kleiner Perkins, Lightspeed Venture Partners, Mantis VC, Redpoint Ventures, Sequoia Capital, and Spark Capital.</p></div><p><strong>Principal Product Security Engineer</strong></p> <p><strong>The role, in a nutshell</strong></p> <p>At Chainguard, our security posture is our competitive advantage. In this principal‑level role, you will:</p> <ul> <li>Set product security direction across major products and platforms.</li> <li>Lead multi‑quarter, cross‑functional security initiatives that materially reduce risk.</li> <li>Embed security by design into roadmaps and day‑to‑day engineering work.</li> </ul> <p>You’ll operate with high autonomy, working directly with engineering and product leadership to turn high‑level risk into concrete, shippable plans.</p> <p><strong>What you’ll do</strong></p> <ul> <li><strong>Shape product security strategy</strong><strong><br></strong>Define and evolve security guardrails for AI-assisted development from design and coding through testing, review, deployment and operations so teams can move quickly while using AI responsibly.</li> <li><strong>Lead large‑scale security initiatives</strong><strong><br></strong>Own cross‑functional programs (e.g., secure SDLC improvements, vulnerability reduction) that span multiple teams and quarters.</li> <li><strong>Accelerate vulnerability remediation and automation</strong><strong><br></strong>Partner with engineering to build automation for vulnerability detection, triage, and remediation (including STIGs/CIS baselines and policy‑as‑code), shortening time‑to‑fix for critical issues.</li> <li><strong>Evolve security assurance programs</strong><strong><br></strong>Improve how we run and consume pentests, vulnerability assessments, bug bounty programs, and red‑team activity so findings become lasting engineering and process changes.</li> <li><strong>Champion secure‑by‑default tooling</strong><strong><br></strong>Guide adoption and integration of security tools (static/dynamic analysis, dependency and license checks, IaC scanners) into CI/CD in a way that works with, not against, developer workflows.</li> <li><strong>Support compliance in sensible ways</strong><strong><br></strong>Help maintain and use frameworks like SOC 2, ISO 27001, NIST, and NIS2 to drive automation‑friendly, durable controls into our products and platforms.</li> <li><stron