# Staff Vulnerability Management Engineer

**Company:** [Chainguard](https://hotfix.jobs/companies/chainguard)
**Location:** Remote
**Role:** Security Engineering
**Salary:** $170k – $231k/yr
**Experience:** 7+ years
**Skills:** Vulnerability Management, Responsible Disclosure, Open Source, Python, Java, JavaScript, Go, Cve, Cna, Container Security, Security Research, Penetration Testing, Bug Bounties, Linux Foundation, Cisa
**Posted:** 2026-08-14

> Leads vulnerability disclosure operations at scale, including novel vulnerability measurement, CVE assignment, embargo coordination, and industry collaboration. The Staff individual contributor provides technical leadership and requires extensive software security or open source experience.

## Job Description

## Responsibilities

- Manage the novel vulnerabilities pipeline.
- Own measurement, disclosure, and reporting for thousands of novel vulnerabilities identified weekly by frontier models and other sources.
- Calibrate response processes based on emerging trends.
- Report newly discovered vulnerabilities to upstream projects and maintainers.
- Run the CNA program and assign new CVEs where necessary.
- Coordinate internal and external embargoes with customers, internal engineering teams, and external maintainers.
- Work with the Linux Foundation, CISA, and other organizations to coordinate actions and responses.
- Guide industry direction so emerging standards and norms meet customer needs.
- Represent Chainguard externally and visibly.
- Work with AI model vendors to guide the evolution of the software supply chain.

## Requirements

- 7+ years of experience in software security, open source maintenance, or vulnerability disclosure management.
- Strong understanding of responsible disclosure.
- Practical expertise automating pipelines and processes at large scale while reducing human involvement.
- Deep experience with open source communities.
- Experience coordinating with public-sector organizations or industry standards bodies and working groups.

## Nice to Have

- Established industry thought leadership in vulnerability disclosure management and embargoes.
- Familiarity with Chainguard Images or other minimal, hardened container base-image ecosystems.
- Experience operating a CNA.
- Software engineering background in Python, Java, JavaScript, Go, or similar languages.
- Background in security research, penetration testing, or bug bounties.

## Compensation and Benefits

- Base salary: **$170,000–$231,000 USD**.
- Remote-first culture with team meetups, biannual destination summits, and a monthly coworking, phone, and internet stipend.
- Stock options upon hire and promotion; eligibility to participate in secondary offerings and a 10-year option exercise period.
- 100% covered health, vision, and dental insurance premiums for employees and dependents.
- Flexible time off.
- 18 weeks of paid parental leave for birthing parents and 12 weeks for non-birthing parents.

## Similar jobs

- [Staff IAM Engineer](https://hotfix.jobs/jobs/7a722d47-b173-4ffc-9981-f10ed9f3ce9c) - Ironclad - San Francisco, CA - $170k – $190k/yr
- [Staff Security Researcher](https://hotfix.jobs/jobs/6b308cd8-be33-459a-b904-08e54567ad7b) - GitLab - Remote - $168k – $238k/yr
- [Staff Security Engineer, IAM](https://hotfix.jobs/jobs/f79f024d-e0b6-41b0-b434-9f047bfa2630) - GitLab - Remote - $168k – $238k/yr
- [Staff Corporate Security Engineer](https://hotfix.jobs/jobs/f89034fc-b54a-4d06-a7c4-971c896526ac) - GitLab - Remote - $168k – $238k/yr
- [Staff Identity Governance and Access Engineer](https://hotfix.jobs/jobs/8fe7fe60-ff7a-48f4-a805-f3f100e1814f) - Okta - Bellevue, WA - $161k – $221k/yr

**Apply:** https://hotfix.jobs/jobs/f6eb93ea-70d6-496f-a251-e679113fd047
**Canonical:** https://hotfix.jobs/jobs/f6eb93ea-70d6-496f-a251-e679113fd047