Senior Product Security Engineer — Remote & Cloud-Native

Chainguard; Canada; Remote; CAD 120,000 - 180,000; Full time

Benefits offered by this job

Remote-first culture

Stock options

Health insurance

Flexible time off

Parental leave

Job summary

Chainguard is seeking a Senior Product Security Engineer to embed in the secure development lifecycle, shipping hardened, production-ready software and building secure pipelines across cloud-native stacks.

You will design and enforce SBOM provenance, implement SLSA/Sigstore controls, and lead security reviews for Kubernetes workloads on AWS and GCP, while maintaining lean, automated gates to catch issues before production.

Qualifications

• 5+ years in software or security engineering with hands-on security responsibility.
• Strong proficiency in Go or Python and production-grade code review.
• Deep hands-on Kubernetes production experience (RBAC, network policies, admission controllers).
• Practical experience with GCP and/or AWS IAM, workload identity, secrets management.
• Proven track record securing CI/CD pipelines (GitHub Actions, Cloud Build, Tekton).
• Fluency with container security (image scanning, distroless, runtime security).
• Experience with software supply chain tooling (Sigstore, SLSA, SBOM).
• Solid understanding of OWASP, NIST, and cloud security frameworks.

Responsibilities

• Design, build, and harden secure CI/CD pipelines with security gates.
• Capture and quantify risk exposure of Chainguard products.
• Enforce software supply chain security controls (signing, SBOMs, provenance).
• Identify customer security needs and translate into robust solutions.
• Lead security architecture reviews for Kubernetes workloads on cloud providers.

Skills

Go

Python

Kubernetes

Cloud Security

CI/CD

SBOM/SLSA

Sigstore/Cosign

OWASP/NIST

Tools

GitHub Actions

Cloud Build

Tekton

Sigstore

Cosign

Job description

Chainguard is seeking a Senior Product Security Engineer to embed in the secure development lifecycle, shipping hardened, production-ready software and building secure pipelines across cloud-native stacks.

You will design and enforce SBOM provenance, implement SLSA/Sigstore controls, and lead security reviews for Kubernetes workloads on AWS and GCP, while maintaining lean, automated gates to catch issues before production.