Full-Time
Staff Product Security Engineer
Chainguard
501-1,000 employees
Software supply chain audits and observability
No salary listed
Remote in UK
Remote
 IT & Security (1) |
|---|
Get referred to Chainguard
See people who can refer or advise you
- At least 7 years of experience in software engineering, security engineering, or a combined role with meaningful hands-on security responsibility throughout.
- Strong proficiency in Go or Python, including writing, reviewing, and debugging production-quality code.
- Deep, hands-on production experience with Kubernetes, including cluster hardening, role-based access control, network policies, and admission controllers.
- Practical expertise with Google Cloud Platform and/or Amazon Web Services, including identity and access management, workload identity, secrets management, and security services such as Google Cloud Security Command Center and AWS Security Hub.
- A proven track record designing and securing continuous integration and continuous delivery pipelines using GitHub Actions, Cloud Build, Tekton, or similar tools.
- Fluency with container security, including image scanning, distroless or minimal base images, and runtime security.
- Experience with software supply chain security tooling and frameworks, including Sigstore, SLSA, and software bill of materials generation.
- A solid understanding of OWASP, NIST, and cloud security frameworks, with the ability to apply them pragmatically.
- Design, build, and maintain secure continuous integration and continuous delivery pipelines with security gates that identify issues before production.
- Systematically and automatically capture the risk exposure of Chainguard products.
- Implement and enforce software supply chain security controls, including signed artifacts, software bills of materials, and provenance attestation using SLSA and Sigstore/Cosign.
- Identify emerging customer security needs and build solutions to address them.
- Lead security architecture reviews and threat models for Kubernetes-based workloads running on Google Cloud Platform and Amazon Web Services.
- Harden container images, Kubernetes cluster configurations, and cloud identity and access management postures to minimize attack surface across the product stack.
- Define and drive adoption of baseline security standards, including pod security standards, network policies, workload identity, and secrets management.
- Evaluate and operationalize cloud-native application protection platform and cloud security posture management tooling for continuous visibility into cloud-native risk.
- Familiarity with Chainguard Images or other minimal or hardened container base-image ecosystems.
- Experience with policy-as-code tools such as Open Policy Agent, Kyverno, and Conftest.
- Contributions to open source security projects.
- A background in security research or offensive security, including bug bounty programs, capture-the-flag competitions, or penetration testing.
Chainguard operates in the software supply chain risk management space. It audits both internal and external supply chains to identify risks, then delivers reports with concrete remediations, improvements, and next steps to reduce exposure. The company also provides a curated base container image distro, Chainguard Image, a ready-to-use, secure software base that simplifies switching to a trusted container ecosystem. Revenue comes from audits and report delivery, plus subscriptions or usage around the curated image distro and related observability services. Chainguard offers supply chain observability, helping customers track what is running, its origin, and dependencies to meet industry standards and frameworks. The goal is to improve the integrity and security of software supply chains for businesses that rely on them, especially those with complex software dependencies.
Company Size
501-1,000
Company Stage
Growth Equity (Venture Capital)
Total Funding
$892M
Headquarters
Kirkland, Washington
Founded
2021
Get referred to Chainguard
See people who can refer or advise you
Simplify's Take
What believers are saying
- Athena added Akamai, JFrog, Morgan Stanley, Qualys, Upwind, and Zafran on July 8, 2026.
- Aug. 6, 2026 Apiiro joined Athena, making AutoFix free for open-source maintainers.
- Chainguard added malware avoidance beta Aug. 4, 2026 and shipped 25 images that week.
What critics are saying
- August 4, 2026 AWS partnership validates product, but commoditizes supply-chain packaging quickly.
- Chainguard depends on upstream maintainers; abandoned projects stall remediation and slow Athena's durable fixes.
- A Factory or signing compromise would poison trusted artifacts and destroy Chainguard's core promise.
What makes Chainguard unique
- Aug. 4, 2026 AWS Security Hub Extended named Chainguard inaugural Supply Chain partner.
- Chainguard rebuilds packages from verified source in isolated Factory, not scanning after release.
- Athena processed 40,000 vulnerabilities by July 8, 2026, plus 2,000 patches across 500 projects.
Help us improve and share your feedback! Did you find this helpful?
Benefits
Equity/stock options
Unlimited Paid Time Off
Remote Work Options
Home Office Stipend
Health Insurance
Wellness Program
Growth & Insights and Company News
6 month growth
↑ 0%1 year growth
↑ 3%2 year growth
↑ 10%Apiiro expands open source security with Chainguard Athena coalition. August 6, 2026 Apiiro has joined Chainguard's Athena coalition and is offering its AI-powered AutoFix tool free to open-source maintainers, helping accelerate vulnerability remediation as AI-driven threats continue to grow. Apiiro has joined Chainguard's Athena coalition and is making its AI-powered AutoFix tool available free of charge to open-source maintainers, reinforcing community efforts to defend open-source software against AI-powered attacks. As part of the collaboration, Apiiro and Chainguard are integrating their platforms to automate vulnerability prioritisation and remediation. The move enables open-source maintainers to generate contextual code fixes faster while helping organisations identify and address vulnerabilities that pose the greatest business risk. Athena has already processed more than 40,000 AI-discovered vulnerabilities, coordinating ecosystem-wide responses to emerging AI-driven threats. Apiiro joins coalition members including J.P. Morgan, Morgan Stanley, Cisco, Cloudflare, Akamai and Qualys in expanding the industry's collaborative defence of open-source software. Apiiro's Guardian Agent contributes newly discovered vulnerabilities to the Athena community while notifying customers when coalition findings affect their software. It prioritises vulnerabilities based on software architecture, runtime exposure and business impact, then uses AutoFix to generate contextual fixes, validate them through automated testing and create review-ready pull requests. Apiiro also integrates Chainguard's remediation status into its Risk Graph, allowing organisations to focus on vulnerabilities relevant to their own software. "The challenge is fixing vulnerabilities quickly without disrupting business-critical applications. By joining Athena, we are bringing organizations the context they need to understand which vulnerabilities actually affect their software architecture, which pose a real risk to the business, and how to fix them automatically without breaking their software. AI alone does not secure software. Context does," said Idan Plotnik, Co-Founder and CEO of Apiiro. The integration is available immediately for joint Apiiro and Chainguard customers, while open-source maintainers can now request free access to AutoFix.
Chainguard joins AWS Security Hub Extended to strengthen open source Supply Chain security. August 5, 2026 Chainguard has launched the Chainguard Libraries service via AWS Security Hub Extended as a partner in the new Supply Chain category, thereby allowing AWS customers to bolster software supply chain security through the use of malware-free, secure-by-default replacement packages for any public open source dependencies. This will allow companies to avoid getting compromised open source packages into their development, CI/CD, and production environments in light of the rising threat posed by more and more sophisticated malware that utilizes artificial intelligence. Unlike most scanning tools, which only find out about threats after the malicious packages have been distributed, Chainguard rebuilds open source packages from trusted source code in an isolated environment called the Chainguard Factory. Supply Chain Management Through AWS Security Hub Extended, customers can purchase Chainguard Libraries using existing AWS contracts, consolidate billing, access centralized security findings using the Open Cybersecurity Schema Framework (OCSF), and receive unified Level 1 support for Enterprise Support plans. The integration is designed to reduce procurement complexity while improving visibility and protection against software supply chain threats without disrupting developer productivity. "Open source is the foundation the world's software is built on. When that ecosystem gets compromised, the blast radius is enormous," said Patrick Donahue, Senior Vice President of Product, Chainguard. "AWS adding us as a partner for supply chain security with the Extended plan is a real signal that the industry is treating this problem with the seriousness it deserves. Chainguard delivers that protection to customers with open source that's trustworthy by default."
Chainguard has joined AWS Security Hub Extended as a partner in its new Supply Chain category. The integration allows AWS customers to access Chainguard Libraries, which replaces public open source dependencies with malware-free packages rebuilt from verified source code. The partnership addresses rising threats from compromised open source packages. According to Chainguard, over 98% of malware ships as pre-built packages with no matching source code, often spreading globally before detection. Through AWS Security Hub Extended, customers can purchase Chainguard Libraries using existing AWS contracts with Enterprise Discount Program discounts applied. Each package is rebuilt from verified source in Chainguard's SLSA Level 3 build environment and delivered with signed provenance and software bills of materials. Chainguard customers include Anduril, Canva, OpenAI, Snap, and Snowflake. The company is backed by investors including Sequoia Capital, Lightspeed Venture Partners, and Kleiner Perkins.
Apiiro has joined Chainguard's Athena coalition to combat AI-driven vulnerabilities in open source software. The company is making its AutoFix tool free for open source maintainers and integrating its platform with Chainguard's. Athena has processed more than 40,000 AI-discovered vulnerabilities. The coalition includes J.P. Morgan, Morgan Stanley, Cisco, Cloudflare, Akamai, and Qualys. Apiiro CEO Idan Plotnik said frontier AI models are discovering novel vulnerabilities at unprecedented speed. The company's platform uses software architecture, runtime exposure, and business context to help organisations prioritise and fix vulnerabilities without disrupting production environments. The integration allows Apiiro to reflect Chainguard's remediation status in its Risk Graph whilst evaluating findings against customer software architecture.
Creationline boosts AI software security with Chainguard. Last updated: July 28, 2026 10:47 am Creationline has partnered with Chainguard to bring software supply chain security into its AI Security and Governance Solutions portfolio, expanding its support for enterprises building AI-powered applications and cloud-native systems. As AI development keeps growing, it leans more and more on open-source software, but security risks don't stay neatly inside the applications anymore. Problems can show up in container images, third party libraries, or even in those malicious packages that get slipped into open-source repositories. And because of that, software supply chain attacks have become a real concern, not just a theoretical one. What makes it so tricky is that these threats are often hard to spot using older, more traditional security practices, so orgs end up having to re-think how they protect today's development setups, you know. Through this partnership Creationline will provide Chainguard's set of security products to enterprise customers across Japan. The portfolio includes container images built with zero known vulnerabilities, securely verified open-source libraries, operating system packages with built-in Software Bills of Materials, hardened virtual machine images, protected GitHub Actions, and security capabilities designed for AI agents. The goal is straightforward. Help organizations reduce known vulnerabilities before software reaches production instead of relying on constant patching later. Alongside stronger protection against supply chain attacks, businesses can improve software transparency, reduce engineering effort spent on security maintenance, and build AI applications on a more secure foundation. Creationline will also provide local implementation support as companies strengthen security across their software development lifecycle in response to the growing demands of AI-driven development.