SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 229,000 - 258,000 / annual
Chainguard is seeking a Principal Product Security Engineer to set product security direction and lead organization-wide security initiatives. The role operates with high autonomy, working directly with engineering and product leadership to embed security by design into products and platforms.
Key responsibilities include:
• Shape product security strategy by defining security guardrails for AI-assisted development across design, coding, testing, review, deployment, and operations.
• Lead large-scale, multi-quarter security initiatives spanning multiple teams, such as secure SDLC improvements and vulnerability reduction programs.
• Accelerate vulnerability remediation by partnering with engineering to build automation for detection, triage, and remediation, including STIGs/CIS baselines and policy-as-code.
• Evolve security assurance programs by improving how the organization runs pentests, vulnerability assessments, bug bounty programs, and red-team activities to drive lasting engineering and process changes.
• Champion secure-by-default tooling by guiding adoption of static/dynamic analysis, dependency and license checks, and IaC scanners into CI/CD workflows.
• Support compliance frameworks (SOC 2, ISO 27001, NIST, NIS2) by driving automation-friendly, durable controls into products and platforms.
• Influence senior leaders and mentor Product Security Engineers, bringing clear risk framing and trade-off analysis to engineering and product decisions.
• Track emerging threats and supply-chain risks, translating them into concrete changes to controls, tooling, and product direction.
Chainguard delivers hardened, secure, production-ready builds of open source software. Customers include Fortune 500 enterprises and global leaders like OpenAI, Snap Inc., and Snowflake. The company is venture-backed by top-tier investors including Sequoia Capital, Kleiner Perkins, and Lightspeed Venture Partners.
REQUIREMENTS:
• 10+ years in software, product, or application security with ownership of complex products or platforms.
• Deep expertise in secure architecture and system design for cloud-native or distributed systems, including modern authorization/authentication and defense-in-depth patterns.
• Experience driving organization-level risk management and security programs (secure SDLC, AI SDLC, vulnerability management) from design through rollout.
• Strong hands-on familiarity with cloud-native environments (containers, Kubernetes, public cloud) and associated security controls.
• Experience with security compliance frameworks (SOC 2, ISO 27001, SLSA) and translating controls into practical engineering work.
• Ability to automate security workflows in at least one language (Go, Python, Shell) and integrate them into CI/CD.
• Proven ability to influence senior stakeholders and drive alignment across teams through clear communication in a remote-first environment.
• High bar for ownership, accountability, and adaptability; ability to anticipate risks, navigate ambiguity, and improve systems and teams.
NICE TO HAVES:
• Background in software supply chain security (SBOMs, SLSA, provenance, signing, build system hardening).
• Experience with red-teaming, offensive security, or open source software development in security-sensitive projects.
• Public speaking or writing on security topics; participation in industry communities or standards.
• Prior experience in early-stage or high-growth companies where security must move at product speed.
About Chainguard
AI / Data / Infrastructure; Legal / Compliance / Risk — software supply-chain security and trusted container images.
