Senior Product Security Engineer: Cloud & Pipelines Lead

Chainguard; United States; Remote; USD 157,000 - 184,000; Full time

Benefits offered by this job

Remote-friendly culture

Equity stock options

Health insurance for you and depend‑ 1

Flexible time off

Parental leave

Job summary

Chainguard seeks a deeply technical security-focused engineer to embed in our secure software pipelines. You will design and maintain hardened CI/CD processes, enforce supply-chain controls, and model threats for Kubernetes workloads on GCP/AWS.

You will apply container security, SBOM and Sigstore/SLSA tooling, and influence secure defaults across Chainguard products. This role emphasizes hands-on implementation and proactive customer-focused solutions.

Qualifications

• 5+ years in software engineering, security engineering, or a combined role with meaningful hands-on security responsibility throughout.
• Strong proficiency in Go or Python with ability to write, review, and debug production-quality code.
• Deep, hands-on experience with Kubernetes in production (cluster hardening, RBAC, network policies, admission controllers).
• Practical expertise with GCP and/or AWS: IAM, workload identity, secrets management, security services (e.g., GCP Security Command Center, AWS Security Hub).
• Proven track record designing and securing CI/CD pipelines (GitHub Actions, Cloud Build, Tekton, or similar).
• Fluency with container security: image scanning, distroless/minimal base images, runtime security.
• Experience with software supply chain security tooling and frameworks (Sigstore, SLSA, SBOM generation).
• Solid understanding of OWASP, NIST, and cloud security frameworks and how to apply them pragmatically.

Responsibilities

• Design, build, and maintain secure CI/CD pipelines with security gates that catch issues before they reach production.
• Systematically capture the risk exposure of Chainguard’s products.
• Implement and enforce software supply chain security controls: signed artifacts, SBOMs, provenance attestation (SLSA, Sigstore / Cosign).
• Proactively identify emerging customer security needs, and build solutions to meet these.
• Lead security architecture reviews and threat modeling for Kubernetes-based workloads on GCP and AWS.
• Harden container images, Kubernetes configs, and cloud IAM postures across the product stack.

Skills

Go

Python

Kubernetes production

Cloud IAM

SBOM

Sigstore

SLSA

OWASP/NIST

CI/CD security

Security gates

Tools

GitHub Actions

Cloud Build

Tekton

Cosign

Job description

Chainguard seeks a deeply technical security-focused engineer to embed in our secure software pipelines. You will design and maintain hardened CI/CD processes, enforce supply-chain controls, and model threats for Kubernetes workloads on GCP/AWS.

You will apply container security, SBOM and Sigstore/SLSA tooling, and influence secure defaults across Chainguard products. This role emphasizes hands-on implementation and proactive customer-focused solutions.