Remote Staff Product Security Engineer - Secure CI/CD

Chainguard; Northern (KY); Hybrid; USD 170,000 - 231,000; Full time

Benefits offered by this job

Remote-first

Stock options

Health insurance

Flexible time off

Parental leave

Job summary

Chainguard is seeking a Staff Product Security Engineer to own secure CI/CD and cloud-native security across our product stack.

You will harden Kubernetes deployments on AWS/GCP, implement SBOMs and Sigstore, and lead security reviews with engineering teams to reduce risk and improve resilience.

Join a remote-first culture with strong equity, comprehensive health coverage, and a commitment to open source security excellence.

Qualifications

• 7+ years in software or security engineering with hands-on security responsibility.
• Strong Go or Python production coding skills.
• Hands-on Kubernetes in production including RBAC and policies.
• Experience with GCP and/or AWS IAM, workload identity, secrets management.
• Proven record designing secure CI/CD pipelines (GitHub Actions, Cloud Build, Tekton).
• Fluency in container security: image scanning and minimal base images.
• Experience with security tooling: Sigstore, SLSA, SBOM generation.
• Solid understanding of OWASP, NIST and cloud security frameworks.

Responsibilities

• Design, build, and maintain secure CI/CD pipelines with security gates pre-production.
• Capture the risk exposure of Chainguard's products automatically.
• Enforce software supply chain controls: signed artifacts, SBOMs, provenance attestation.
• Identify security needs and build solutions for customers.
• Lead security architecture reviews and threat models for Kubernetes workloads on GCP/AWS.
• Harden container images, Kubernetes configs, and cloud IAM postures.
• Define baseline security standards: pod security, network policies, workload identity, secrets.
• Evaluate CNAPP/CSPM tools to maintain cloud-native visibility.

Skills

Go/Python

Kubernetes security

Cloud (GCP/AWS)

CI/CD security

Container security

Supply chain tooling

Security frameworks

Tools

GitHub Actions

Cloud Build

Tekton

Job description

Chainguard is seeking a Staff Product Security Engineer to own secure CI/CD and cloud-native security across our product stack.

You will harden Kubernetes deployments on AWS/GCP, implement SBOMs and Sigstore, and lead security reviews with engineering teams to reduce risk and improve resilience.

Join a remote-first culture with strong equity, comprehensive health coverage, and a commitment to open source security excellence.