Chainguard — Job Pipeline Surface

Forgejo bucket: marcus/job-chainguard. Maintained as part of Scott's Staff+ SWE job-pipeline. Surface only — no public posts, no outreach sent, until sscoble approves.

1. Why Chainguard

Chainguard's product is the canonical dark-factory: supply-chain attacks where a poisoned upstream package reaches production and the human is not in the loop. Their internal "Chainguard Factory" builds OSS artifacts at SLSA L3 — "every line is verified, hardened, and traceable" by construction — which is the literal Speckl thesis at artifact scale. Speckl is a complement to Sigstore, not an extension: Speckl is upstream of the build (specifies what should exist, with what constraints); Sigstore attests to the build output (what was actually built, signed, attested). The two stack — Speckl adds intent provenance (the spec the artifact was generated from) on top of Factory 2.0's existing SLSA L3 artifact provenance. Co-founder Dan Lorenc co-founded Sigstore, making this the only company on the shortlist where the founder's tagline is structurally congruent with Scott's.

2. JD snapshot

Field	Value
Title	Engineering Manager, Internal Developer Platform
Department	Internal Developer Platform
Level	Engineering Manager (Staff-equivalent leadership)
Location	US (Remote)
Remote/hybrid/on-site	Remote (US)
Comp range (base)	Not posted (estimated $180–200K base, Series C+)
Comp range (total)	Estimated $250K+ all-in (equity-heavy at Series C+)
Req ID	Via Ashby — re-verify at outreach time
Posting URL	https://app.ashbyhq.com/chainguard
Updated	2026-07-07 (v3 shortlist research pass)
Tech stack named	K8s, containers, Sigstore, SLSA L3, CI/CD, Go, Python
Soft requirements	Active OSS contributor, supply-chain security experience, K8s/container infra
Years experience	8+ (EM-level)

Additional open roles (verified live on Ashby, 71 total)

• Staff Software Engineer (Athena) (US/UK/Canada Remote)
• Principal Software Engineer (Athena) (US/UK/Canada Remote)
• Senior Software Engineer (Containers) (US Remote)
• Senior Software Engineer (Customer Platform) (US Remote)
• Senior Software Engineer (Guarded OS) (US Remote)
• Staff Software Engineer (Customer Platform) (US/UK/Canada Remote)
• Staff Software Engineer (Guarded Containers) (US Remote)
• Senior/Staff Security Engineer (AI Platform) — Speckl adjacent
• Principal Product Security Researcher (US/Canada/UK Remote) — Speckl adjacent

Full JD body

Verbatim JD text should be pasted here from the Ashby job board at outreach time. The v3 shortlist captured the role titles, locations, and requirements; the full JD body for the Engineering Manager, Internal Developer Platform role will be fetched from https://app.ashbyhq.com/chainguard before outreach is approved.

Key verified product context from v3 research:

• "The trusted source for open source." Hardened, secure, production-ready builds of OSS that prevent AI attacks. Containers, libraries, VMs, OS packages, agent skills, GitHub Actions. SLSA L3-compliant build pipeline.
• Featured customer story: "Anduril Trusts Chainguard to Innovate at Mission Speed and Scale."
• Listed in the 2026 Gartner Magic Quadrant for Software Supply Chain Security.
• "Chainguard Factory" — internal build system. Recent blog: "Chainguard admitted Factory 1.0 was 'brittle.' Here's how 2.0 fixes it."
• Homepage: "When engineering teams ship more code with AI, every open source artifact expands the attack surface. Building from source in a SLSA L3-compliant Factory is how Chainguard ensures that every line is verified, hardened, and traceable."
• Scale: 424,000+ engineering hours saved for customers, 106,000+ CVEs remediated, 97.6% avg reduction in CVEs, 85% attack-surface reduction, 4.8★ on G2.
• Values (verified): "Bias for intentional action — We prioritize, plan, test, fail, learn, and grow." "Trust each other and assume good intentions."

3. Public surface

Hiring manager (highest confidence)

• Name: Dan Lorenc
• Title: CEO / Co-founder (also co-founded Sigstore — the Linux Foundation project for software supply-chain signing)
• GH handle: @dlorenc
• LinkedIn: (to be verified — public profile expected)
• Email domain: chainguard.dev (not directly verified in this pass)
• Signals: Co-founder of Sigstore; ~10 years in OSS Kubernetes / supply-chain community (Kubernetes SIG, CNCF). Only company on the shortlist where the founder's product thesis is structurally congruent with Scott's Speckl thesis.
• Confidence: high (founder identity, role, and Sigstore co-founding are publicly verified)

Adjacent public figures (good reply targets before DM)

• Matt Moore — CTO / co-founder — deep Kubernetes, Sigstore, Distroless contributor — GitHub/LinkedIn to be verified
• Ville Aikas — co-founder — Sigstore / Kubernetes ecosystem — GitHub/LinkedIn to be verified

Highest-value reads (3-5)

• "Chainguard admitted Factory 1.0 was 'brittle.' Here's how 2.0 fixes it." — Chainguard blog — demonstrates the "correct by construction" thesis
• "AI is supercharging hackers. These 4 startups are using AI to fight back." — Chainguard newsroom, March 24, 2026 — the AI-attack × supply-chain nexus
• Sigstore project documentation / Dan Lorenc talks at KubeCon — the OSS provenance standard Scott's work complements
• Chainguard About page — "every line is verified, hardened, and traceable" — the literal Speckl pitch
• Gartner 2026 Magic Quadrant for Software Supply Chain Security — market validation

4. Artifact plan

Premise

The Speckl × Chainguard demo is a Kafka KRaft provenance compile that demonstrates intent-level provenance at the build layer — complementing Chainguard's artifact-level SLSA L3 provenance. Speckl is upstream of the build (the spec the artifact was generated from); Sigstore attests to the build output. The two stack. The artifact proves Scott can build the thing that composes with what Chainguard ships.

Repo layout

marcus/job-chainguard/
├── README.md
└── (references https://github.com/wscoble/speckl-kafka-kraft)

Artifact URL

https://github.com/wscoble/speckl-kafka-kraft

This is the Speckl × Chainguard demo. Build path is git clone + cd speckl-kafka-kraft. Expected deliverable is a working 4-artifact compile output.

What it demonstrates

• Intent-level provenance compiled through Speckl for a Kafka KRaft cluster
• Content-addressed, reproducible build artifacts
• Provenance that complements (not competes with) Chainguard's artifact-level SLSA L3 story
• A working compile output a hiring manager can clone, build, and verify

Effort estimate

<50 hours (demo already built; README + packaging for external consumption is the remaining work)

Sketch

# Build path
git clone https://github.com/wscoble/speckl-kafka-kraft
cd speckl-kafka-kraft
# Expected: 4-artifact compile output (Speckl provenance manifests)

5. Outreach log

date	recipient	channel	artifact attached	reply	next step
—	—	—	—	—	—

No outreach has been sent. No public posts have been made. Per directive from the parent, surface only. Outreach log stays empty until sscoble approves first contact.

6. Sources + confidence

Fact	Source	Confidence
JD body (role titles, locations)	app.ashbyhq.com/chainguard (v3 research pass, 2026-07-07)	high
Comp range	Not posted; estimated from Series C+ stage	low (estimate)
Hiring manager name (Dan Lorenc)	Chainguard About page + public press + Sigstore project	high
Dan Lorenc = Sigstore co-founder	Public Linux Foundation / Sigstore documentation	high
Matt Moore (CTO/co-founder)	v3 shortlist research pass	high
Ville Aikas (co-founder)	v3 shortlist research pass	high
Artifact plan	Parent-derived (Speckl × Chainguard consulting wedge)	parent-supplied
Artifact URL	https://github.com/wscoble/speckl-kafka-kraft	high

---

Captured 2026-07-07 by the job-pipeline subagent. Parent context: Scott's job-pipeline strategy, consult-pilot campaign. v3 shortlist file: ~/.hermes/cache/job-search/scott-shortlist-2026-07-07-v3.md.