Principal Product Security Engineer

Chainguard

. Set product security direction across major products and platforms.

Posted 10/23/2026full-timeRemote • CanadaLeadWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive expertise in software and application security, with a focus on secure architecture, risk management, and vulnerability reduction. Proficient in automating security workflows and integrating security practices into CI/CD processes while maintaining compliance with industry standards.

Highest-signal resume keywords

10+ Years In Software SecuritySecure Architecture And System DesignCloud-Native EnvironmentsSecurity Compliance FrameworksAutomation In Go, Python, Or Shell

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Secure SDLCVulnerability ManagementRisk ManagementStatic/Dynamic AnalysisDependency ChecksIaC ScannersPenetration TestingBug Bounty ProgramsDefense-In-Depth PatternsModern Authz/Authn

Soft Skills

Clear CommunicationInfluencing StakeholdersHigh OwnershipAdaptabilityMentoring

Tools & Technologies

ContainersKubernetesPublic CloudCI/CD IntegrationAutomation Tools

Certifications & Qualifications

SOC 2ISO 27001NISTNIS2

Industry Keywords

AI SDLCVulnerability ReductionSecurity By DesignSupply Chain SecurityRed-Teaming

Tech Stack

Tools & technologies

CloudDistributed SystemsKubernetesOpen SourcePythonSDLCGo

About the role

Key responsibilities & impact

Set product security direction across major products and platforms.
Lead multi-quarter, cross-functional security initiatives that materially reduce risk.
Embed security by design into roadmaps and day-to-day engineering work.
Define and evolve security guardrails for AI-assisted development across design, coding, testing, review, deployment, and operations.
Own cross-functional programs such as secure SDLC improvements and vulnerability reduction across multiple teams and quarters.
Partner with engineering to build automation for vulnerability detection, triage, and remediation, including STIGs/CIS baselines and policy-as-code.
Improve the operation and use of penetration tests, vulnerability assessments, bug bounty programs, and red-team activity.
Guide adoption and CI/CD integration of static/dynamic analysis, dependency and license checks, and IaC scanners.
Help maintain and use SOC 2, ISO 27001, NIST, and NIS2 frameworks to drive durable controls.
Influence engineering and product leaders with clear risk framing and trade-off options.
Mentor Product Security Engineers and raise the security bar across the organization.
Track emerging threats and supply-chain risks and translate them into changes to controls, tooling, and product direction.

Requirements

What you’ll need

10+ years in software, product, or application security, with ownership of complex products or platforms.
Deep expertise in secure architecture and system design for cloud-native or distributed systems, including modern authz/authn and defense-in-depth patterns.
Experience driving org-level risk management and security programs, including secure SDLC, AI SDLC, and vulnerability management, from design through rollout.
Strong hands-on familiarity with cloud-native environments, including containers, Kubernetes, public cloud, and associated security controls.
Experience with security compliance frameworks such as SOC 2, ISO 27001, and SLSA, and translating controls into practical engineering work.
Ability to automate security workflows in at least one language, such as Go, Python, or Shell, and integrate them into CI/CD.
Proven ability to influence senior stakeholders and drive alignment across teams through clear, concise communication in a remote-first environment.
High ownership, accountability, and adaptability; ability to anticipate risks, navigate ambiguity, and improve systems and teams.
Nice to have: Background in software supply chain security, including SBOMs, SLSA, provenance, signing, and build system hardening.
Nice to have: Experience with red-teaming or offensive security and/or open source software development in security-sensitive projects.
Nice to have: Public speaking or writing on security topics and participation in industry communities or standards.
Nice to have: Prior experience in early-stage or high-growth companies.

Benefits

Comp & perks

Flexible & Remote-First Culture: Work remotely with team meetup opportunities, bi-annual destination summits, and a monthly stipend for coworking spaces, phone and internet costs.
Stock options upon hire and promotion
Participation in secondary offerings
10 years to exercise stock options
100% covered health, vision and dental insurance premiums for employee and dependents
∞ Flexible Time Off
18 weeks paid parental leave for birthing parents and 12 weeks for non-birthing parents
Option to use parental leave all at once or throughout the child's first year