Staff Open-Source Vulnerability Security Engineer

Chainguard; United States; On-site; USD 170,000 - 231,000; Full time

Benefits offered by this job

Remote-first culture

Stock options (10 yrs)

Health insurance

Flexible time off

Parental leave

Job summary

Chainguard is hiring a Staff Vulnerability Management Engineer to advance security in the open source software supply chain. You will own the pipeline for vulnerabilities identified by frontier models and other sources, calibrate response processes, and coordinate with upstream maintainers and external bodies to shape industry standards.

You will lead cross-team efforts, work with model vendors, and help Chainguard stay ahead on vulnerability disclosure and embargo management in a remote-first,

Qualifications

• 7+ years in software security, open source maintenance, or vulnerability disclosure management.
• Strong understanding of responsible disclosure.
• Experience automating pipelines to operate at large scale with minimal human intervention.
• Deep experience with open source communities.
• Experience coordinating with public sector or industry standards bodies.

Responsibilities

• Own the measurement, disclosure and reporting of our vulnerability pipeline.
• Calibrate response processes for emerging trends and incidents.
• Coordinate disclosure to upstream projects and maintainers; manage embargoes.
• Run CNA program to assign CVEs when needed.
• Collaborate with Linux Foundation, CISA and other bodies on industry actions.
• Represent Chainguard externally and guide industry standards directions.
• Work with AI model vendors to shape future supply chain practices.

Skills

Software security

Open source maintenance

Vulnerability disclosure

Automation pipelines

Industry standards

Tools

Python

Java

JavaScript

Go

Job description

Chainguard is hiring a Staff Vulnerability Management Engineer to advance security in the open source software supply chain. You will own the pipeline for vulnerabilities identified by frontier models and other sources, calibrate response processes, and coordinate with upstream maintainers and external bodies to shape industry standards.

You will lead cross-team efforts, work with model vendors, and help Chainguard stay ahead on vulnerability disclosure and embargo management in a remote-first,