RemoteLeaf Logo
Log in Sign up

Staff Product Security Engineer

23 hours, 59 minutes ago
United Kingdom
Full-time
Lead
Application Security Engineer
Cybersecurity
AWS CI/CD GCP GitHub Actions Go Kubernetes OWASP Penetration Testing Python Secrets Management Tekton
Apply Now
Chainguard

Chainguard

Chainguard: Fortified Software Delivery Security for developers and CISOs, ensuring secure by default infrastructure and zero workflow friction.

Internet Software & Services
51-250
Founded 2021
$55M raised
View All Jobs 61

Description

  • Design, build, and maintain secure CI/CD pipelines with security gates that catch issues before production.
  • Systematically capture and monitor the risk exposure of Chainguard products.
  • Implement and enforce software supply chain security controls such as signed artifacts, SBOMs, and provenance attestation.
  • Proactively identify emerging customer security needs and build solutions to address them.
  • Lead security architecture reviews and threat models for Kubernetes-based workloads running on GCP and AWS.
  • Harden container images, Kubernetes cluster configurations, and cloud IAM postures to reduce attack surface.
  • Define and drive adoption of baseline security standards including pod security standards, network policies, workload identity, and secrets management.
  • Evaluate and operationalize CNAPP/CSPM tooling to maintain continuous visibility into cloud-native risk.
  • Provide technical leadership and cross-team influence as an individual contributor on hard security problems.

Requirements

  • 7+ years of experience in software engineering, security engineering, or a combined role with substantial hands-on security responsibility.
  • Strong proficiency in Go or Python, including the ability to write, review, and debug production-quality code.
  • Deep hands-on experience with Kubernetes in production, including cluster hardening, RBAC, network policies, and admission controllers.
  • Practical expertise with GCP and/or AWS, including IAM, workload identity, secrets management, and security services such as GCP Security Command Center or AWS Security Hub.
  • Proven experience designing and securing CI/CD pipelines using tools such as GitHub Actions, Cloud Build, Tekton, or similar.
  • Fluency in container security, including image scanning, distroless or minimal base images, and runtime security.
  • Experience with software supply chain security tooling and frameworks such as Sigstore, SLSA, and SBOM generation.
  • Solid understanding of OWASP, NIST, and cloud security frameworks and how to apply them pragmatically.
  • Familiarity with Chainguard Images or other minimal/hardened container base image ecosystems is preferred.
  • Experience with policy-as-code tools such as OPA, Kyverno, or Conftest is a plus.
  • Contributions to open source security projects are preferred.
  • Background in security research or offensive security, such as bug bounty, CTFs, or penetration testing, is preferred.

Benefits

  • Flexible remote-first culture with team meetup opportunities and bi-annual destination summits.
  • Monthly stipend for coworking spaces, phone, and internet costs.
  • Stock options upon hire and promotion, plus participation in secondary offerings and a 10-year exercise window.
  • 100% company-covered health, vision, and dental insurance for employees and dependents.
  • Unlimited flexible time off.
  • 18 weeks paid parental leave for birthing parents and 12 weeks for non-birthing parents.

Interested in this position?

Apply directly on the company website

Apply Now

Similar Roles

Onit

Senior Application Security Engineer

Onit 251-1K IT Services

Onit is hiring a Senior Application Security Engineer in Pune to secure its SaaS applications, APIs, and AI-driven platform through hands-on security architecture, risk assessment, and vulnerability management.

India Full-time Senior Application Security Engineer
AWS Azure CI/CD DevSecOps GCP GraphQL OAuth OpenID Connect REST API SAML SonarQube System Design
4 hours, 57 minutes ago
Funding Societies

Product Security Intern

Funding Societies 251-1K Capital Markets

Funding Societies | Modalku is seeking a Product Security Intern to help strengthen secure software development and security automation across its engineering environment using Generative AI and modern security tooling.

India Indonesia Malaysia Singapore Thailand Full-time Entry Level AI Engineer Application Security Engineer
Bash CI/CD Cybersecurity Encryption Generative AI Git Go JavaScript LLM Penetration Testing Python
21 hours, 14 minutes ago
NEORIS

Ingeniero Seguridad en Aplicaciones

NEORIS 5K-10K Internet Software & Services

NEORIS is hiring an Application Security Engineer to support secure software development and vulnerability management for banking platforms in a collaborative digital services environment.

Ecuador Full-time Junior Application Security Engineer
Agile Cybersecurity LLM
1 day ago
Airtable

Product Security Engineer

Airtable 1K-5K IT Services

Airtable is hiring a Product Security Engineer to secure its application layer as the platform expands its AI and LLM-powered offerings.

United States Full-time Senior Application Security Engineer
$187k-$260k
JavaScript Node.js Penetration Testing TypeScript
2 days ago

You're on a roll! Sign up now to keep applying.

Sign Up

Already have an account? Log in

Used by 14,729+ remote workers