From c16129ce7f2a1550c57795868c84871d66f6ded5 Mon Sep 17 00:00:00 2001 From: sscoble Date: Tue, 7 Jul 2026 21:08:20 -0700 Subject: [PATCH] =?UTF-8?q?Initial=20README=20=E2=80=94=20job-pipeline=20s?= =?UTF-8?q?urface=20for=20Chainguard=20(6-section=20template,=20outreach?= =?UTF-8?q?=20log=20empty)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- README.md | 146 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 146 insertions(+) create mode 100644 README.md diff --git a/README.md b/README.md new file mode 100644 index 0000000..4cca164 --- /dev/null +++ b/README.md @@ -0,0 +1,146 @@ +# `Chainguard` — Job Pipeline Surface + +> Forgejo bucket: `marcus/job-chainguard`. Maintained as part of Scott's +> Staff+ SWE job-pipeline. **Surface only** — no public posts, no +> outreach sent, until `sscoble` approves. + +## 1. Why Chainguard + +Chainguard's product is the canonical dark-factory: supply-chain attacks where a poisoned upstream package reaches production and the human is *not in the loop*. Their internal "Chainguard Factory" builds OSS artifacts at SLSA L3 — "every line is verified, hardened, and traceable" by construction — which is the literal Speckl thesis at artifact scale. The Speckl × Chainguard demo (Kafka KRaft provenance compile) demonstrates intent-level provenance that *complements* Chainguard's artifact-level provenance, not competes with it. Co-founder Dan Lorenc co-founded Sigstore, making this the only company on the shortlist where the founder's tagline is structurally congruent with Scott's. + +## 2. JD snapshot + +| Field | Value | +|---|---| +| Title | Engineering Manager, Internal Developer Platform | +| Department | Internal Developer Platform | +| Level | Engineering Manager (Staff-equivalent leadership) | +| Location | US (Remote) | +| Remote/hybrid/on-site | Remote (US) | +| Comp range (base) | Not posted (estimated $180–200K base, Series C+) | +| Comp range (total) | Estimated $250K+ all-in (equity-heavy at Series C+) | +| Req ID | Via Ashby — re-verify at outreach time | +| Posting URL | https://app.ashbyhq.com/chainguard | +| Updated | 2026-07-07 (v3 shortlist research pass) | +| Tech stack named | K8s, containers, Sigstore, SLSA L3, CI/CD, Go, Python | +| Soft requirements | Active OSS contributor, supply-chain security experience, K8s/container infra | +| Years experience | 8+ (EM-level) | + +### Additional open roles (verified live on Ashby, 71 total) + +- **Staff Software Engineer (Athena)** (US/UK/Canada Remote) +- **Principal Software Engineer (Athena)** (US/UK/Canada Remote) +- **Senior Software Engineer (Containers)** (US Remote) +- **Senior Software Engineer (Customer Platform)** (US Remote) +- **Senior Software Engineer (Guarded OS)** (US Remote) +- **Staff Software Engineer (Customer Platform)** (US/UK/Canada Remote) +- **Staff Software Engineer (Guarded Containers)** (US Remote) +- **Senior/Staff Security Engineer (AI Platform)** — Speckl adjacent +- **Principal Product Security Researcher** (US/Canada/UK Remote) — Speckl adjacent + +### Full JD body + +*Verbatim JD text should be pasted here from the Ashby job board at outreach time. The v3 shortlist captured the role titles, locations, and requirements; the full JD body for the Engineering Manager, Internal Developer Platform role will be fetched from `https://app.ashbyhq.com/chainguard` before outreach is approved.* + +**Key verified product context from v3 research:** +- "The trusted source for open source." Hardened, secure, production-ready builds of OSS that prevent AI attacks. Containers, libraries, VMs, OS packages, agent skills, GitHub Actions. SLSA L3-compliant build pipeline. +- Featured customer story: *"Anduril Trusts Chainguard to Innovate at Mission Speed and Scale."* +- Listed in the 2026 Gartner Magic Quadrant for Software Supply Chain Security. +- "Chainguard Factory" — internal build system. Recent blog: *"Chainguard admitted Factory 1.0 was 'brittle.' Here's how 2.0 fixes it."* +- Homepage: *"When engineering teams ship more code with AI, every open source artifact expands the attack surface. Building from source in a SLSA L3-compliant Factory is how Chainguard ensures that every line is verified, hardened, and traceable."* +- Scale: 424,000+ engineering hours saved for customers, 106,000+ CVEs remediated, 97.6% avg reduction in CVEs, 85% attack-surface reduction, 4.8★ on G2. +- Values (verified): "Bias for intentional action — We prioritize, plan, test, fail, learn, and grow." "Trust each other and assume good intentions." + +## 3. Public surface + +### Hiring manager (highest confidence) + +- **Name:** Dan Lorenc +- **Title:** CEO / Co-founder (also co-founded Sigstore — the Linux Foundation project for software supply-chain signing) +- **GH handle:** [@dlorenc](https://github.com/dlorenc) +- **LinkedIn:** (to be verified — public profile expected) +- **Email domain:** chainguard.dev (not directly verified in this pass) +- **Signals:** Co-founder of Sigstore; ~10 years in OSS Kubernetes / supply-chain community (Kubernetes SIG, CNCF). Only company on the shortlist where the founder's product thesis is structurally congruent with Scott's Speckl thesis. +- **Confidence:** high (founder identity, role, and Sigstore co-founding are publicly verified) + +### Adjacent public figures (good reply targets before DM) + +- **Matt Moore** — CTO / co-founder — deep Kubernetes, Sigstore, Distroless contributor — GitHub/LinkedIn to be verified +- **Ville Aikas** — co-founder — Sigstore / Kubernetes ecosystem — GitHub/LinkedIn to be verified + +### Highest-value reads (3-5) + +- *"Chainguard admitted Factory 1.0 was 'brittle.' Here's how 2.0 fixes it."* — Chainguard blog — demonstrates the "correct by construction" thesis +- *"AI is supercharging hackers. These 4 startups are using AI to fight back."* — Chainguard newsroom, March 24, 2026 — the AI-attack × supply-chain nexus +- Sigstore project documentation / Dan Lorenc talks at KubeCon — the OSS provenance standard Scott's work complements +- Chainguard About page — "every line is verified, hardened, and traceable" — the literal Speckl pitch +- Gartner 2026 Magic Quadrant for Software Supply Chain Security — market validation + +## 4. Artifact plan + +### Premise + +The Speckl × Chainguard demo is a Kafka KRaft provenance compile that demonstrates intent-level provenance at the build layer — complementing Chainguard's artifact-level SLSA L3 provenance. The artifact proves Scott can build the thing that extends what Chainguard ships. + +### Repo layout + +``` +marcus/job-chainguard/ +├── README.md +└── (references https://github.com/wscoble/speckl-kafka-kraft) +``` + +### Artifact URL + +**https://github.com/wscoble/speckl-kafka-kraft** + +This is the Speckl × Chainguard demo. Build path is `git clone` + `cd speckl-kafka-kraft`. Expected deliverable is a working 4-artifact compile output. + +### What it demonstrates + +- Intent-level provenance compiled through Speckl for a Kafka KRaft cluster +- Content-addressed, reproducible build artifacts +- Provenance that *complements* (not competes with) Chainguard's artifact-level SLSA L3 story +- A working compile output a hiring manager can clone, build, and verify + +### Effort estimate + +<50 hours (demo already built; README + packaging for external consumption is the remaining work) + +### Sketch + +```bash +# Build path +git clone https://github.com/wscoble/speckl-kafka-kraft +cd speckl-kafka-kraft +# Expected: 4-artifact compile output (Speckl provenance manifests) +``` + +## 5. Outreach log + +| date | recipient | channel | artifact attached | reply | next step | +|---|---|---|---|---|---| +| — | — | — | — | — | — | + +**No outreach has been sent. No public posts have been made.** Per +directive from the parent, surface only. Outreach log stays empty until +`sscoble` approves first contact. + +## 6. Sources + confidence + +| Fact | Source | Confidence | +|---|---|---| +| JD body (role titles, locations) | `app.ashbyhq.com/chainguard` (v3 research pass, 2026-07-07) | high | +| Comp range | Not posted; estimated from Series C+ stage | low (estimate) | +| Hiring manager name (Dan Lorenc) | Chainguard About page + public press + Sigstore project | high | +| Dan Lorenc = Sigstore co-founder | Public Linux Foundation / Sigstore documentation | high | +| Matt Moore (CTO/co-founder) | v3 shortlist research pass | high | +| Ville Aikas (co-founder) | v3 shortlist research pass | high | +| Artifact plan | Parent-derived (Speckl × Chainguard consulting wedge) | parent-supplied | +| Artifact URL | https://github.com/wscoble/speckl-kafka-kraft | high | + +--- + +*Captured 2026-07-07 by the job-pipeline subagent. Parent context: +Scott's job-pipeline strategy, consult-pilot campaign. v3 shortlist +file: `~/.hermes/cache/job-search/scott-shortlist-2026-07-07-v3.md`.*