Principal Product Security Engineer

Chainguard

. Set product security direction across major products and platforms.

Posted 10/23/2026full-timeRemote • United KingdomLeadWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive expertise in software, product, and application security, with a focus on secure architecture, risk management, and vulnerability reduction. Proficient in automating security workflows and integrating security practices into CI/CD processes while maintaining compliance with industry standards.

Highest-signal resume keywords

10+ Years In Software SecuritySecure Architecture And System DesignVulnerability Management And Secure SDLCAutomation In Go, Python, Or ShellExperience With SOC 2 And ISO 27001

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Secure ArchitectureVulnerability ManagementRisk ManagementAutomationContainersKubernetesCloud SecurityStatic/Dynamic AnalysisPenetration TestingRed-Teaming

Soft Skills

Clear CommunicationInfluencing StakeholdersMentoringAdaptabilityHigh Ownership

Tools & Technologies

CI/CDSTIGsCIS BaselinesPolicy-As-CodeIaC ScannersBug Bounty ProgramsSecurity Compliance Frameworks

Certifications & Qualifications

SOC 2ISO 27001NISTNIS2

Industry Keywords

AI SDLCSoftware Supply Chain SecuritySBOMsSLSAProvenanceSigningBuild System Hardening

Tech Stack

Tools & technologies

CloudDistributed SystemsKubernetesOpen SourcePythonSDLCGo

About the role

Key responsibilities & impact

Set product security direction across major products and platforms.
Lead multi-quarter, cross-functional security initiatives that materially reduce risk.
Embed security by design into roadmaps and day-to-day engineering work.
Define and evolve security guardrails for AI-assisted development across design, coding, testing, review, deployment, and operations.
Own cross-functional programs such as secure SDLC improvements and vulnerability reduction.
Partner with engineering to build automation for vulnerability detection, triage, and remediation, including STIGs/CIS baselines and policy-as-code.
Improve the use of penetration tests, vulnerability assessments, bug bounty programs, and red-team activity so findings lead to lasting engineering and process changes.
Guide adoption and integration of static/dynamic analysis, dependency and license checks, and IaC scanners into CI/CD.
Help maintain and use SOC 2, ISO 27001, NIST, and NIS2 frameworks to drive durable controls.
Bring risk framing and trade-off options to engineering and product leaders.
Mentor Product Security Engineers and raise the security bar across the organization.
Track emerging threats and supply-chain risks and translate them into changes to controls, tooling, and product direction.

Requirements

What you’ll need

10+ years in software, product, or application security, with ownership of complex products or platforms.
Deep expertise in secure architecture and system design for cloud-native or distributed systems.
Knowledge of modern authorization/authentication and defense-in-depth patterns.
Experience driving organization-level risk management and security programs, including secure SDLC, AI SDLC, and vulnerability management, from design through rollout.
Strong hands-on familiarity with containers, Kubernetes, public cloud, and associated security controls.
Experience with security compliance frameworks such as SOC 2, ISO 27001, and SLSA.
Ability to automate security workflows in at least one language, such as Go, Python, or Shell, and integrate them into CI/CD.
Proven ability to influence senior stakeholders and drive alignment across teams through clear, concise communication in a remote-first environment.
High ownership, accountability, and adaptability.
Background in software supply chain security, including SBOMs, SLSA, provenance, signing, and build system hardening is nice to have.
Experience with red-teaming or offensive security and/or open source software development in security-sensitive projects is nice to have.
Public speaking or writing on security topics and participation in industry communities or standards is nice to have.
Prior experience in early-stage or high-growth companies is nice to have.

Benefits

Comp & perks

Flexible & Remote-First Culture: Work remotely with team meetup opportunities, bi-annual destination summits, and a monthly stipend for coworking spaces, phone and internet costs.
Receive stock options upon hire and promotion.
Participate in secondary offerings.
10 years to exercise stock options.
100% covered health, vision and dental insurance premiums for the employee and dependents.
Unlimited flexible time off.
18 weeks paid parental leave for birthing parents and 12 weeks for non-birthing parents, usable all at once or throughout the child's first year.
Team meetup opportunities.
Bi-annual destination summits.
Monthly stipend for coworking spaces, phone and internet costs.