Staff Vulnerability Management Engineer

Overview

Lead vulnerability management for a pipeline of novel vulnerabilities identified by frontier models and other sources. This individual-contributor Staff role provides technical leadership, cross-team influence, and ownership of complex vulnerability disclosure and coordination efforts.

What you'll do

• Manage the novel vulnerabilities pipeline.
• Measure, disclose, and report thousands of vulnerabilities identified weekly.
• Calibrate response processes to emerging trends.
• Report newly discovered vulnerabilities to upstream projects and maintainers.
• Run the CNA program and assign CVEs where necessary.
• Coordinate internal and external embargoes with customers, engineers, and maintainers.
• Coordinate vulnerability actions with the Linux Foundation, CISA, and other industry bodies.

What you'll need

• 7+ years in software security, open source maintenance, or vulnerability disclosure management.
• Strong understanding of responsible disclosure.
• Practical expertise automating large-scale pipelines and processes.
• Deep experience with open source communities.
• Experience coordinating with public-sector or industry standards bodies and working groups.

Nice to have

• Industry thought leadership in vulnerability disclosure management and embargoes.
• Familiarity with Chainguard Images or minimal and hardened container base image ecosystems.
• Experience operating a CNA.
• Software engineering experience in Python, Java, JavaScript, Go, or similar languages.
• Background in security research, penetration testing, or bug bounties.

Details

• Remote role in the United Kingdom.