Staff Product Security Engineer: Secure CI/CD & Cloud-Native

Chainguard; United States; Remote; USD 150,000 - 210,000; Full time

Job summary

Chainguard is seeking a Staff Product Security Engineer to embed security into every stage of the software delivery lifecycle. You will design and maintain secure CI/CD pipelines, enforce supply-chain controls, and proactively address customer security needs.

You will lead security architecture reviews for Kubernetes workloads on GCP/AWS, harden images and IAM postures, and drive baseline security standards across the product stack.

Qualifications

• 7+ years in software engineering, security engineering, or a hands-on security role.
• Proficiency in Go or Python with production-quality code capability.
• Deep Kubernetes production experience including RBAC and policy controls.
• Hands-on with GCP and/or AWS IAM, workload identity, and secret management.
• Track record securing CI/CD pipelines (GitHub Actions, Cloud Build, Tekton).
• Fluency in container security, image scanning, and minimal base images.
• Experience with software supply chain security tooling (Sigstore, SLSA, SBOMs).
• Strong knowledge of OWASP, NIST, and cloud security frameworks.

Responsibilities

• Design, build, and maintain secure CI/CD pipelines with security gates.
• Capture risk exposure of Chainguard products and enforce controls.
• Lead security architecture reviews and threat modeling for cloud workloads.
• Harden container images, Kubernetes configs, and cloud IAM postures.
• Define baseline security standards and adopt tooling for ongoing risk visibility.

Skills

Go

Python

Kubernetes

GCP

AWS

CI/CD pipelines

Security tooling

SBOM/SLSA

Tools

Cosign

Sigstore

Job description

Chainguard is seeking a Staff Product Security Engineer to embed security into every stage of the software delivery lifecycle. You will design and maintain secure CI/CD pipelines, enforce supply-chain controls, and proactively address customer security needs.

You will lead security architecture reviews for Kubernetes workloads on GCP/AWS, harden images and IAM postures, and drive baseline security standards across the product stack.