SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Chainguard is a venture-backed software supply-chain security company that delivers hardened, secure, production-ready builds of open source software. The company serves Fortune 500 enterprises and global leaders including OpenAI, Snap Inc., Snowflake, and others.
In this principal-level role, you will set product security direction across major products and platforms, operating with high autonomy and working directly with engineering and product leadership. Your responsibilities include:
**Key Responsibilities:**
- Shape product security strategy by defining security guardrails for AI-assisted development across design, coding, testing, review, deployment, and operations.
- Lead large-scale, cross-functional security initiatives spanning multiple teams and quarters, such as secure SDLC improvements and vulnerability reduction programs.
- Accelerate vulnerability remediation by partnering with engineering to build automation for detection, triage, and remediation, including STIGs/CIS baselines and policy-as-code.
- Evolve security assurance programs by improving how the organization runs pentests, vulnerability assessments, bug bounty programs, and red-team activities to drive lasting engineering changes.
- Champion secure-by-default tooling by guiding adoption of static/dynamic analysis, dependency checks, license scanning, and IaC scanners into CI/CD workflows.
- Support compliance frameworks (SOC 2, ISO 27001, NIST, NIS2) by driving automation-friendly, durable controls into products and platforms.
- Influence senior leaders and mentor Product Security Engineers, raising the security bar across the organization.
- Track emerging threats and supply-chain risks, translating them into concrete changes to controls, tooling, and product direction.
**Requirements:**
- 10+ years in software, product, or application security with ownership of complex products or platforms.
- Deep expertise in secure architecture and system design for cloud-native or distributed systems, including modern authorization/authentication and defense-in-depth patterns.
- Experience driving organization-level risk management and security programs (secure SDLC, AI SDLC, vulnerability management) from design through rollout.
- Strong hands-on familiarity with cloud-native environments (containers, Kubernetes, public cloud) and associated security controls.
- Experience with security compliance frameworks (SOC 2, ISO 27001, SLSA) and translating controls into practical engineering work.
- Ability to automate security workflows in at least one language (Go, Python, Shell) and integrate them into CI/CD.
- Proven ability to influence senior stakeholders and drive alignment across teams through clear communication in a remote-first environment.
- High bar for ownership, accountability, and adaptability; ability to anticipate risks, navigate ambiguity, and leave systems and teams better than found.
**Nice to Haves:**
- Background in software supply chain security (SBOMs, SLSA, provenance, signing, build system hardening).
- Experience with red-teaming, offensive security, or open source software development in security-sensitive projects.
- Public speaking or writing on security topics; participation in industry communities or standards.
- Prior experience in early-stage or high-growth companies where security moves at product speed.
About Chainguard
AI / Data / Infrastructure; Legal / Compliance / Risk — software supply-chain security and trusted container images.
