Remote-First Staff Vulnerability Engineer

Chainguard; Northern (KY); Hybrid; USD 170,000 - 231,000; Full time

Benefits offered by this job

Remote-first culture

Stock options

100% health insurance

Unlimited PTO

18 weeks parental leave

Job summary

Chainguard is seeking a Staff Vulnerability Management Engineer to lead disclosure for a broad pipeline of vulnerabilities discovered by frontier models and other sources. You will drive standardized response processes, coordinate with industry bodies, and represent Chainguard in external efforts.

You will own CNA operations, manage CVE assignments, and collaborate with customers and engineering teams to ensure timely, responsible remediation and communication.

Qualifications

• 7+ years in software security or vulnerability disclosure management.
• Strong understanding of responsible disclosure.
• Experience automating pipelines and processes at scale.
• Deep experience with open source communities.
• Experience coordinating with public sector or industry standards bodies.

Responsibilities

• Own the measurement, disclosure and reporting of the vulnerability pipeline identified by frontier models and other sources.
• Calibrate the response process in reaction to emerging trends.
• Manage reporting of newly discovered vulnerabilities to upstream projects and maintainers.
• Run CNA program to assign new CVEs where necessary.
• Coordinate embargoes with customers, internal teams, and external maintainers.

Skills

7+ years security

Open source communities

Automation pipelines

Responsible disclosure

Standards coordination

Job description

Chainguard is seeking a Staff Vulnerability Management Engineer to lead disclosure for a broad pipeline of vulnerabilities discovered by frontier models and other sources. You will drive standardized response processes, coordinate with industry bodies, and represent Chainguard in external efforts.

You will own CNA operations, manage CVE assignments, and collaborate with customers and engineering teams to ensure timely, responsible remediation and communication.