# `Chainguard` — Job Pipeline Surface

> Forgejo bucket: `marcus/job-chainguard`. Maintained as part of Scott's
> Staff+ SWE job-pipeline. **Surface only** — no public posts, no
> outreach sent, until `sscoble` approves.

## 1. Why Chainguard

Chainguard's product is the canonical dark-factory: supply-chain attacks where a poisoned upstream package reaches production and the human is *not in the loop*. Their internal "Chainguard Factory" builds OSS artifacts at SLSA L3 — "every line is verified, hardened, and traceable" by construction — which is the literal Speckl thesis at artifact scale. Speckl is a **complement** to Sigstore, not an extension: Speckl is upstream of the build (specifies what should exist, with what constraints); Sigstore attests to the build output (what was actually built, signed, attested). The two stack — Speckl adds *intent provenance* (the spec the artifact was generated from) on top of Factory 2.0's existing SLSA L3 artifact provenance. Co-founder Dan Lorenc co-founded Sigstore, making this the only company on the shortlist where the founder's tagline is structurally congruent with Scott's.

## 2. JD snapshot

| Field | Value |
|---|---|
| Title | Engineering Manager, Internal Developer Platform |
| Department | Internal Developer Platform |
| Level | Engineering Manager (Staff-equivalent leadership) |
| Location | US (Remote) |
| Remote/hybrid/on-site | Remote (US) |
| Comp range (base) | Not posted (estimated $180–200K base, Series C+) |
| Comp range (total) | Estimated $250K+ all-in (equity-heavy at Series C+) |
| Req ID | Via Ashby — re-verify at outreach time |
| Posting URL | https://app.ashbyhq.com/chainguard |
| Updated | 2026-07-07 (v3 shortlist research pass) |
| Tech stack named | K8s, containers, Sigstore, SLSA L3, CI/CD, Go, Python |
| Soft requirements | Active OSS contributor, supply-chain security experience, K8s/container infra |
| Years experience | 8+ (EM-level) |

### Additional open roles (verified live on Ashby, 71 total)

- **Staff Software Engineer (Athena)** (US/UK/Canada Remote)
- **Principal Software Engineer (Athena)** (US/UK/Canada Remote)
- **Senior Software Engineer (Containers)** (US Remote)
- **Senior Software Engineer (Customer Platform)** (US Remote)
- **Senior Software Engineer (Guarded OS)** (US Remote)
- **Staff Software Engineer (Customer Platform)** (US/UK/Canada Remote)
- **Staff Software Engineer (Guarded Containers)** (US Remote)
- **Senior/Staff Security Engineer (AI Platform)** — Speckl adjacent
- **Principal Product Security Researcher** (US/Canada/UK Remote) — Speckl adjacent

### Full JD body

*Verbatim JD text should be pasted here from the Ashby job board at outreach time. The v3 shortlist captured the role titles, locations, and requirements; the full JD body for the Engineering Manager, Internal Developer Platform role will be fetched from `https://app.ashbyhq.com/chainguard` before outreach is approved.*

**Key verified product context from v3 research:**
- "The trusted source for open source." Hardened, secure, production-ready builds of OSS that prevent AI attacks. Containers, libraries, VMs, OS packages, agent skills, GitHub Actions. SLSA L3-compliant build pipeline.
- Featured customer story: *"Anduril Trusts Chainguard to Innovate at Mission Speed and Scale."*
- Listed in the 2026 Gartner Magic Quadrant for Software Supply Chain Security.
- "Chainguard Factory" — internal build system. Recent blog: *"Chainguard admitted Factory 1.0 was 'brittle.' Here's how 2.0 fixes it."*
- Homepage: *"When engineering teams ship more code with AI, every open source artifact expands the attack surface. Building from source in a SLSA L3-compliant Factory is how Chainguard ensures that every line is verified, hardened, and traceable."*
- Scale: 424,000+ engineering hours saved for customers, 106,000+ CVEs remediated, 97.6% avg reduction in CVEs, 85% attack-surface reduction, 4.8★ on G2.
- Values (verified): "Bias for intentional action — We prioritize, plan, test, fail, learn, and grow." "Trust each other and assume good intentions."

## 3. Public surface

### Hiring manager (highest confidence)

- **Name:** Dan Lorenc
- **Title:** CEO / Co-founder (also co-founded Sigstore — the Linux Foundation project for software supply-chain signing)
- **GH handle:** [@dlorenc](https://github.com/dlorenc)
- **LinkedIn:** (to be verified — public profile expected)
- **Email domain:** chainguard.dev (not directly verified in this pass)
- **Signals:** Co-founder of Sigstore; ~10 years in OSS Kubernetes / supply-chain community (Kubernetes SIG, CNCF). Only company on the shortlist where the founder's product thesis is structurally congruent with Scott's Speckl thesis.
- **Confidence:** high (founder identity, role, and Sigstore co-founding are publicly verified)

### Adjacent public figures (good reply targets before DM)

- **Matt Moore** — CTO / co-founder — deep Kubernetes, Sigstore, Distroless contributor — GitHub/LinkedIn to be verified
- **Ville Aikas** — co-founder — Sigstore / Kubernetes ecosystem — GitHub/LinkedIn to be verified

### Highest-value reads (3-5)

- *"Chainguard admitted Factory 1.0 was 'brittle.' Here's how 2.0 fixes it."* — Chainguard blog — demonstrates the "correct by construction" thesis
- *"AI is supercharging hackers. These 4 startups are using AI to fight back."* — Chainguard newsroom, March 24, 2026 — the AI-attack × supply-chain nexus
- Sigstore project documentation / Dan Lorenc talks at KubeCon — the OSS provenance standard Scott's work complements
- Chainguard About page — "every line is verified, hardened, and traceable" — the literal Speckl pitch
- Gartner 2026 Magic Quadrant for Software Supply Chain Security — market validation

## 4. Artifact plan

### Premise

The Speckl × Chainguard demo is a Kafka KRaft provenance compile that demonstrates intent-level provenance at the build layer — complementing Chainguard's artifact-level SLSA L3 provenance. Speckl is upstream of the build (the spec the artifact was generated from); Sigstore attests to the build output. The two stack. The artifact proves Scott can build the thing that composes with what Chainguard ships.

### Repo layout

```
marcus/job-chainguard/
├── README.md
└── (references https://github.com/wscoble/speckl-kafka-kraft)
```

### Artifact URL

**https://github.com/wscoble/speckl-kafka-kraft**

This is the Speckl × Chainguard demo. Build path is `git clone` + `cd speckl-kafka-kraft`. Expected deliverable is a working 4-artifact compile output.

### What it demonstrates

- Intent-level provenance compiled through Speckl for a Kafka KRaft cluster
- Content-addressed, reproducible build artifacts
- Provenance that *complements* (not competes with) Chainguard's artifact-level SLSA L3 story
- A working compile output a hiring manager can clone, build, and verify

### Effort estimate

<50 hours (demo already built; README + packaging for external consumption is the remaining work)

### Sketch

```bash
# Build path
git clone https://github.com/wscoble/speckl-kafka-kraft
cd speckl-kafka-kraft
# Expected: 4-artifact compile output (Speckl provenance manifests)
```

## 5. Outreach log

| date | recipient | channel | artifact attached | reply | next step |
|---|---|---|---|---|---|
| — | — | — | — | — | — |

**No outreach has been sent. No public posts have been made.** Per
directive from the parent, surface only. Outreach log stays empty until
`sscoble` approves first contact.

## 6. Sources + confidence

| Fact | Source | Confidence |
|---|---|---|
| JD body (role titles, locations) | `app.ashbyhq.com/chainguard` (v3 research pass, 2026-07-07) | high |
| Comp range | Not posted; estimated from Series C+ stage | low (estimate) |
| Hiring manager name (Dan Lorenc) | Chainguard About page + public press + Sigstore project | high |
| Dan Lorenc = Sigstore co-founder | Public Linux Foundation / Sigstore documentation | high |
| Matt Moore (CTO/co-founder) | v3 shortlist research pass | high |
| Ville Aikas (co-founder) | v3 shortlist research pass | high |
| Artifact plan | Parent-derived (Speckl × Chainguard consulting wedge) | parent-supplied |
| Artifact URL | https://github.com/wscoble/speckl-kafka-kraft | high |

---

*Captured 2026-07-07 by the job-pipeline subagent. Parent context:
Scott's job-pipeline strategy, consult-pilot campaign. v3 shortlist
file: `~/.hermes/cache/job-search/scott-shortlist-2026-07-07-v3.md`.*