marcus/job-chainguard
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Initial README — job-pipeline surface for Chainguard (6-section template, outreach log empty)

Browse source
This commit is contained in:
sscoble 2026-07-07 21:08:20 -07:00
commit c16129ce7f
1 changed files with 146 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

146
README.md Normal file
View file

@ -0,0 +1,146 @@
# `Chainguard` — Job Pipeline Surface
> Forgejo bucket: `marcus/job-chainguard`. Maintained as part of Scott's
> Staff+ SWE job-pipeline. **Surface only** — no public posts, no
> outreach sent, until `sscoble` approves.
## 1. Why Chainguard
Chainguard's product is the canonical dark-factory: supply-chain attacks where a poisoned upstream package reaches production and the human is *not in the loop*. Their internal "Chainguard Factory" builds OSS artifacts at SLSA L3 — "every line is verified, hardened, and traceable" by construction — which is the literal Speckl thesis at artifact scale. The Speckl × Chainguard demo (Kafka KRaft provenance compile) demonstrates intent-level provenance that *complements* Chainguard's artifact-level provenance, not competes with it. Co-founder Dan Lorenc co-founded Sigstore, making this the only company on the shortlist where the founder's tagline is structurally congruent with Scott's.
## 2. JD snapshot
| Field | Value |
|---|---|
| Title | Engineering Manager, Internal Developer Platform |
| Department | Internal Developer Platform |
| Level | Engineering Manager (Staff-equivalent leadership) |
| Location | US (Remote) |
| Remote/hybrid/on-site | Remote (US) |
| Comp range (base) | Not posted (estimated $180–200K base, Series C+) |
| Comp range (total) | Estimated $250K+ all-in (equity-heavy at Series C+) |
| Req ID | Via Ashby — re-verify at outreach time |
| Posting URL | https://app.ashbyhq.com/chainguard |
| Updated | 2026-07-07 (v3 shortlist research pass) |
| Tech stack named | K8s, containers, Sigstore, SLSA L3, CI/CD, Go, Python |
| Soft requirements | Active OSS contributor, supply-chain security experience, K8s/container infra |
| Years experience | 8+ (EM-level) |
### Additional open roles (verified live on Ashby, 71 total)
- **Staff Software Engineer (Athena)** (US/UK/Canada Remote)
- **Principal Software Engineer (Athena)** (US/UK/Canada Remote)
- **Senior Software Engineer (Containers)** (US Remote)
- **Senior Software Engineer (Customer Platform)** (US Remote)
- **Senior Software Engineer (Guarded OS)** (US Remote)
- **Staff Software Engineer (Customer Platform)** (US/UK/Canada Remote)
- **Staff Software Engineer (Guarded Containers)** (US Remote)
- **Senior/Staff Security Engineer (AI Platform)** — Speckl adjacent
- **Principal Product Security Researcher** (US/Canada/UK Remote) — Speckl adjacent
### Full JD body
*Verbatim JD text should be pasted here from the Ashby job board at outreach time. The v3 shortlist captured the role titles, locations, and requirements; the full JD body for the Engineering Manager, Internal Developer Platform role will be fetched from `https://app.ashbyhq.com/chainguard` before outreach is approved.*
**Key verified product context from v3 research:**
- "The trusted source for open source." Hardened, secure, production-ready builds of OSS that prevent AI attacks. Containers, libraries, VMs, OS packages, agent skills, GitHub Actions. SLSA L3-compliant build pipeline.
- Featured customer story: *"Anduril Trusts Chainguard to Innovate at Mission Speed and Scale."*
- Listed in the 2026 Gartner Magic Quadrant for Software Supply Chain Security.
- "Chainguard Factory" — internal build system. Recent blog: *"Chainguard admitted Factory 1.0 was 'brittle.' Here's how 2.0 fixes it."*
- Homepage: *"When engineering teams ship more code with AI, every open source artifact expands the attack surface. Building from source in a SLSA L3-compliant Factory is how Chainguard ensures that every line is verified, hardened, and traceable."*
- Scale: 424,000+ engineering hours saved for customers, 106,000+ CVEs remediated, 97.6% avg reduction in CVEs, 85% attack-surface reduction, 4.8★ on G2.
- Values (verified): "Bias for intentional action — We prioritize, plan, test, fail, learn, and grow." "Trust each other and assume good intentions."
## 3. Public surface
### Hiring manager (highest confidence)
- **Name:** Dan Lorenc
- **Title:** CEO / Co-founder (also co-founded Sigstore — the Linux Foundation project for software supply-chain signing)
- **GH handle:** [@dlorenc](https://github.com/dlorenc)
- **LinkedIn:** (to be verified — public profile expected)
- **Email domain:** chainguard.dev (not directly verified in this pass)
- **Signals:** Co-founder of Sigstore; ~10 years in OSS Kubernetes / supply-chain community (Kubernetes SIG, CNCF). Only company on the shortlist where the founder's product thesis is structurally congruent with Scott's Speckl thesis.
- **Confidence:** high (founder identity, role, and Sigstore co-founding are publicly verified)
### Adjacent public figures (good reply targets before DM)
- **Matt Moore** — CTO / co-founder — deep Kubernetes, Sigstore, Distroless contributor — GitHub/LinkedIn to be verified
- **Ville Aikas** — co-founder — Sigstore / Kubernetes ecosystem — GitHub/LinkedIn to be verified
### Highest-value reads (3-5)
- *"Chainguard admitted Factory 1.0 was 'brittle.' Here's how 2.0 fixes it."* — Chainguard blog — demonstrates the "correct by construction" thesis
- *"AI is supercharging hackers. These 4 startups are using AI to fight back."* — Chainguard newsroom, March 24, 2026 — the AI-attack × supply-chain nexus
- Sigstore project documentation / Dan Lorenc talks at KubeCon — the OSS provenance standard Scott's work complements
- Chainguard About page — "every line is verified, hardened, and traceable" — the literal Speckl pitch
- Gartner 2026 Magic Quadrant for Software Supply Chain Security — market validation
## 4. Artifact plan
### Premise
The Speckl × Chainguard demo is a Kafka KRaft provenance compile that demonstrates intent-level provenance at the build layer — complementing Chainguard's artifact-level SLSA L3 provenance. The artifact proves Scott can build the thing that extends what Chainguard ships.
### Repo layout
```
marcus/job-chainguard/
├── README.md
└── (references https://github.com/wscoble/speckl-kafka-kraft)
```
### Artifact URL
**https://github.com/wscoble/speckl-kafka-kraft**
This is the Speckl × Chainguard demo. Build path is `git clone` + `cd speckl-kafka-kraft`. Expected deliverable is a working 4-artifact compile output.
### What it demonstrates
- Intent-level provenance compiled through Speckl for a Kafka KRaft cluster
- Content-addressed, reproducible build artifacts
- Provenance that *complements* (not competes with) Chainguard's artifact-level SLSA L3 story
- A working compile output a hiring manager can clone, build, and verify
### Effort estimate
<50 hours (demo already built; README + packaging for external consumption is the remaining work)
### Sketch
```bash
# Build path
git clone https://github.com/wscoble/speckl-kafka-kraft
cd speckl-kafka-kraft
# Expected: 4-artifact compile output (Speckl provenance manifests)
```
## 5. Outreach log
| date | recipient | channel | artifact attached | reply | next step |
|---|---|---|---|---|---|
| — | — | — | — | — | — |
**No outreach has been sent. No public posts have been made.** Per
directive from the parent, surface only. Outreach log stays empty until
`sscoble` approves first contact.
## 6. Sources + confidence
| Fact | Source | Confidence |
|---|---|---|
| JD body (role titles, locations) | `app.ashbyhq.com/chainguard` (v3 research pass, 2026-07-07) | high |
| Comp range | Not posted; estimated from Series C+ stage | low (estimate) |
| Hiring manager name (Dan Lorenc) | Chainguard About page + public press + Sigstore project | high |
| Dan Lorenc = Sigstore co-founder | Public Linux Foundation / Sigstore documentation | high |
| Matt Moore (CTO/co-founder) | v3 shortlist research pass | high |
| Ville Aikas (co-founder) | v3 shortlist research pass | high |
| Artifact plan | Parent-derived (Speckl × Chainguard consulting wedge) | parent-supplied |
| Artifact URL | https://github.com/wscoble/speckl-kafka-kraft | high |
---
*Captured 2026-07-07 by the job-pipeline subagent. Parent context:
Scott's job-pipeline strategy, consult-pilot campaign. v3 shortlist
file: `~/.hermes/cache/job-search/scott-shortlist-2026-07-07-v3.md`.*