Principal Product Security Researcher

📋 Description Design, build, and maintain secure CI/CD pipelines with security gates. Systematically capture risk exposure across Halcyon Labs products. Implement and enforce software supply chain security: signed artifacts, SBOMs, provenance attestation (SLSA, Sigstore / Cosign). Proactively identify emerging customer security needs and build solutions to meet them. Lead security architecture reviews and threat models for Kubernetes workloads on GCP and AWS. Harden container images, Kubernetes configs, and cloud IAM postures to minimize attack surface. 🎯 Requirements 7+ years in software or security engineering with hands-on security responsibility. Strong proficiency in Go or Python; able to write, review, and debug production-quality code. Deep, hands-on production Kubernetes experience (cluster hardening, RBAC, network policies, admission controllers). Practical expertise with GCP and/or AWS: IAM, workload identity, secrets management, security services (e.g., Security Command Center / Security Hub). Proven track record securing CI/CD pipelines (GitHub Actions, Cloud Build, Tekton). Container security focus: image scanning, distroless/minimal base images, runtime security. 🎁 Benefits Flexible, remote-first culture with team meetups, destination summits, and coworking stipend. Equity options on hire and promotion; long exercise window (10 years). 100% covered health, vision, and dental insurance for you and dependents. Unlimited flexible time off. 18 weeks paid parental leave (18 weeks birthing, 12 weeks non-birthing).