| README.md | ||
Chainguard — Job Pipeline Surface
Forgejo bucket:
marcus/job-chainguard. Maintained as part of Scott's Staff+ SWE job-pipeline. Surface only — no public posts, no outreach sent, untilsscobleapproves.
1. Why Chainguard
Chainguard's product is the canonical dark-factory: supply-chain attacks where a poisoned upstream package reaches production and the human is not in the loop. Their internal "Chainguard Factory" builds OSS artifacts at SLSA L3 — "every line is verified, hardened, and traceable" by construction — which is the literal Speckl thesis at artifact scale. The Speckl × Chainguard demo (Kafka KRaft provenance compile) demonstrates intent-level provenance that complements Chainguard's artifact-level provenance, not competes with it. Co-founder Dan Lorenc co-founded Sigstore, making this the only company on the shortlist where the founder's tagline is structurally congruent with Scott's.
2. JD snapshot
| Field | Value |
|---|---|
| Title | Engineering Manager, Internal Developer Platform |
| Department | Internal Developer Platform |
| Level | Engineering Manager (Staff-equivalent leadership) |
| Location | US (Remote) |
| Remote/hybrid/on-site | Remote (US) |
| Comp range (base) | Not posted (estimated $180–200K base, Series C+) |
| Comp range (total) | Estimated $250K+ all-in (equity-heavy at Series C+) |
| Req ID | Via Ashby — re-verify at outreach time |
| Posting URL | https://app.ashbyhq.com/chainguard |
| Updated | 2026-07-07 (v3 shortlist research pass) |
| Tech stack named | K8s, containers, Sigstore, SLSA L3, CI/CD, Go, Python |
| Soft requirements | Active OSS contributor, supply-chain security experience, K8s/container infra |
| Years experience | 8+ (EM-level) |
Additional open roles (verified live on Ashby, 71 total)
- Staff Software Engineer (Athena) (US/UK/Canada Remote)
- Principal Software Engineer (Athena) (US/UK/Canada Remote)
- Senior Software Engineer (Containers) (US Remote)
- Senior Software Engineer (Customer Platform) (US Remote)
- Senior Software Engineer (Guarded OS) (US Remote)
- Staff Software Engineer (Customer Platform) (US/UK/Canada Remote)
- Staff Software Engineer (Guarded Containers) (US Remote)
- Senior/Staff Security Engineer (AI Platform) — Speckl adjacent
- Principal Product Security Researcher (US/Canada/UK Remote) — Speckl adjacent
Full JD body
Verbatim JD text should be pasted here from the Ashby job board at outreach time. The v3 shortlist captured the role titles, locations, and requirements; the full JD body for the Engineering Manager, Internal Developer Platform role will be fetched from https://app.ashbyhq.com/chainguard before outreach is approved.
Key verified product context from v3 research:
- "The trusted source for open source." Hardened, secure, production-ready builds of OSS that prevent AI attacks. Containers, libraries, VMs, OS packages, agent skills, GitHub Actions. SLSA L3-compliant build pipeline.
- Featured customer story: "Anduril Trusts Chainguard to Innovate at Mission Speed and Scale."
- Listed in the 2026 Gartner Magic Quadrant for Software Supply Chain Security.
- "Chainguard Factory" — internal build system. Recent blog: "Chainguard admitted Factory 1.0 was 'brittle.' Here's how 2.0 fixes it."
- Homepage: "When engineering teams ship more code with AI, every open source artifact expands the attack surface. Building from source in a SLSA L3-compliant Factory is how Chainguard ensures that every line is verified, hardened, and traceable."
- Scale: 424,000+ engineering hours saved for customers, 106,000+ CVEs remediated, 97.6% avg reduction in CVEs, 85% attack-surface reduction, 4.8★ on G2.
- Values (verified): "Bias for intentional action — We prioritize, plan, test, fail, learn, and grow." "Trust each other and assume good intentions."
3. Public surface
Hiring manager (highest confidence)
- Name: Dan Lorenc
- Title: CEO / Co-founder (also co-founded Sigstore — the Linux Foundation project for software supply-chain signing)
- GH handle: @dlorenc
- LinkedIn: (to be verified — public profile expected)
- Email domain: chainguard.dev (not directly verified in this pass)
- Signals: Co-founder of Sigstore; ~10 years in OSS Kubernetes / supply-chain community (Kubernetes SIG, CNCF). Only company on the shortlist where the founder's product thesis is structurally congruent with Scott's Speckl thesis.
- Confidence: high (founder identity, role, and Sigstore co-founding are publicly verified)
Adjacent public figures (good reply targets before DM)
- Matt Moore — CTO / co-founder — deep Kubernetes, Sigstore, Distroless contributor — GitHub/LinkedIn to be verified
- Ville Aikas — co-founder — Sigstore / Kubernetes ecosystem — GitHub/LinkedIn to be verified
Highest-value reads (3-5)
- "Chainguard admitted Factory 1.0 was 'brittle.' Here's how 2.0 fixes it." — Chainguard blog — demonstrates the "correct by construction" thesis
- "AI is supercharging hackers. These 4 startups are using AI to fight back." — Chainguard newsroom, March 24, 2026 — the AI-attack × supply-chain nexus
- Sigstore project documentation / Dan Lorenc talks at KubeCon — the OSS provenance standard Scott's work complements
- Chainguard About page — "every line is verified, hardened, and traceable" — the literal Speckl pitch
- Gartner 2026 Magic Quadrant for Software Supply Chain Security — market validation
4. Artifact plan
Premise
The Speckl × Chainguard demo is a Kafka KRaft provenance compile that demonstrates intent-level provenance at the build layer — complementing Chainguard's artifact-level SLSA L3 provenance. The artifact proves Scott can build the thing that extends what Chainguard ships.
Repo layout
marcus/job-chainguard/
├── README.md
└── (references https://github.com/wscoble/speckl-kafka-kraft)
Artifact URL
https://github.com/wscoble/speckl-kafka-kraft
This is the Speckl × Chainguard demo. Build path is git clone + cd speckl-kafka-kraft. Expected deliverable is a working 4-artifact compile output.
What it demonstrates
- Intent-level provenance compiled through Speckl for a Kafka KRaft cluster
- Content-addressed, reproducible build artifacts
- Provenance that complements (not competes with) Chainguard's artifact-level SLSA L3 story
- A working compile output a hiring manager can clone, build, and verify
Effort estimate
<50 hours (demo already built; README + packaging for external consumption is the remaining work)
Sketch
# Build path
git clone https://github.com/wscoble/speckl-kafka-kraft
cd speckl-kafka-kraft
# Expected: 4-artifact compile output (Speckl provenance manifests)
5. Outreach log
| date | recipient | channel | artifact attached | reply | next step |
|---|---|---|---|---|---|
| — | — | — | — | — | — |
No outreach has been sent. No public posts have been made. Per
directive from the parent, surface only. Outreach log stays empty until
sscoble approves first contact.
6. Sources + confidence
| Fact | Source | Confidence |
|---|---|---|
| JD body (role titles, locations) | app.ashbyhq.com/chainguard (v3 research pass, 2026-07-07) |
high |
| Comp range | Not posted; estimated from Series C+ stage | low (estimate) |
| Hiring manager name (Dan Lorenc) | Chainguard About page + public press + Sigstore project | high |
| Dan Lorenc = Sigstore co-founder | Public Linux Foundation / Sigstore documentation | high |
| Matt Moore (CTO/co-founder) | v3 shortlist research pass | high |
| Ville Aikas (co-founder) | v3 shortlist research pass | high |
| Artifact plan | Parent-derived (Speckl × Chainguard consulting wedge) | parent-supplied |
| Artifact URL | https://github.com/wscoble/speckl-kafka-kraft | high |
Captured 2026-07-07 by the job-pipeline subagent. Parent context:
Scott's job-pipeline strategy, consult-pilot campaign. v3 shortlist
file: ~/.hermes/cache/job-search/scott-shortlist-2026-07-07-v3.md.