Note: The job is a remote job and is open to candidates in USA. Chainguard is the trusted source for open source, delivering hardened, secure, and production-ready builds that help organizations build faster, stay compliant, and eliminate risk. The Staff Vulnerability Management Engineer will provide technical leadership and cross-team influence while owning the measurement, disclosure, reporting, and coordination of a large-scale novel vulnerabilities pipeline. The role also involves leading industry collaboration, managing CNA and embargo processes, and representing Chainguard externally on AI supply chain security.
Responsibilities
- Own the measurement, disclosure and reporting of our pipeline of thousands of novel vulnerabilities weekly identified by frontier models and other sources
- Calibrate our response process in response to emerging trends
- Manage the reporting of newly discovered vulnerabilities to upstream projects and maintainers
- Run our CNA program to assign new CVEs where necessary
- Co-ordinate internal and external embargoes, working with customers, internal engineering teams, and external maintainers
- Work with the Linux Foundation, CISA, and other bodies to co-ordinate actions and responses
- Guide and lead industry direction to ensure Chainguard customer needs are best met by emerging standards and norms
- Represent Chainguard externally and visibly, to be the face of our industry leading efforts
- Work with AI model vendors to guide future evolution of the software supply chain
Skills
- 7+ years in software security, open source maintenance, or vulnerability disclosure management
- A strong understanding of responsible disclosure
- Practical expertise with automating pipelines and processes, to operate at large scale, and to remove the human-in-the-loop
- Deep experience with open source communities
- Experience in co-ordinating with public sector or industry standards bodies and working groups
- Established thought leadership in the industry relating to vulnerability disclosure management and embargoes
- Familiarity with Chainguard Images or other minimal/hardened container base image ecosystems
- Experience operating a CNA
- Software engineering background in Python, Java, Javascript, Go or similar languages
- Background in security research, pen testing or bug bounties
Benefits
- Flexible & Remote-First Culture: Work remotely with team meetup opportunities, bi-annual destination summits, and a monthly stipend for coworking spaces, phone and internet costs.
- Receive stock options upon hire and promotion. Plus, you can participate in secondary offerings and have 10 years to exercise your options.
- We cover 100% of your health, vision and dental insurance premiums for you and your dependents.
- ∞ Flexible Time Off: Take the time you need.
- 18 Weeks Paid Parental Leave: We offer 18 weeks for birthing parents and 12 weeks for non-birthing parents, with the option to use it all at once or throughout your child's first year.
Company Overview
Company H1B Sponsorship