Staff Vulnerability Management Engineer

Overview

Lead vulnerability management for a pipeline of thousands of novel vulnerabilities identified weekly by frontier models and other sources. This individual-contributor Staff role focuses on technical leadership, cross-team influence, industry coordination, and complex security problems.

What you'll do

• Manage the novel vulnerabilities pipeline.
• Measure, disclose, and report newly identified vulnerabilities.
• Calibrate response processes based on emerging trends.
• Report vulnerabilities to upstream projects and maintainers.
• Run the CNA program and assign CVEs where necessary.
• Coordinate embargoes with customers, engineers, and maintainers.
• Coordinate vulnerability responses with industry bodies and AI model vendors.

What you'll need

• 7+ years in software security, open source maintenance, or vulnerability disclosure management.
• Strong understanding of responsible disclosure.
• Practical expertise automating large-scale pipelines and processes.
• Deep experience with open source communities.
• Experience coordinating with public-sector or industry standards bodies and working groups.

Nice to have

• Thought leadership in vulnerability disclosure management and embargoes.
• Familiarity with Chainguard Images or hardened container base image ecosystems.
• Experience operating a CNA.
• Software engineering experience with Python, Java, JavaScript, Go, or similar languages.
• Background in security research, penetration testing, or bug bounties.

Details

• Remote role in the United States.
• Base salary: $170,000–$231,000 USD annually.