Principal Product Security Researcher, Software Supply Chain
Venture-backed software supply chain security company with a remote-first culture
| Employer | Venture-backed software supply chain security company with a remote-first culture (not named) |
|---|---|
| Location | Remote (U.S.) · Remote |
| Type & level | Full-time · Principal |
| Pay | USD 201k–226k base Source: pay range stated in the source posting |
| Visa path | O-1A fit (senior candidates) |
| Role family | Vulnerability Researcher / Offensive Security |
About the role
This role leads the product security research function at a company that ships hardened open source software builds. The person in it tracks emerging attack patterns in the software supply chain and turns them into plans that shape product roadmaps and architecture. The role also carries an external voice, with talks and thought leadership aimed at the wider industry.
What you'll do
- Set and own the product security research agenda, scanning the wider ecosystem for emerging attack patterns.
- Analyze how new supply chain and product security threats affect the company's products and customers.
- Design mitigations across people, process, and technology that teams will actually adopt.
- Work with executive and senior engineering leaders to influence roadmap and architecture decisions.
- Find systemic weaknesses and build plans that fix root causes rather than symptoms.
- Mentor product security and engineering colleagues and present findings at conferences and in public talks.
Requirements
- Deep experience in product or application security, including leading research or threat-focused work with company-level results.
- Expert knowledge across several areas such as secure architecture, software supply chain, and organizational risk management.
- Proven ability to present complex ideas to executives and drive decisions.
- Comfort owning ambiguous cross-functional problems and turning them into prioritized initiatives.
- Ability to work independently with high ownership while collaborating well with others.
Nice to have
Pay & benefits
USD 201k–226k base. The posting lists stock options at hire and promotion with a 10-year exercise window, fully covered health, vision, and dental premiums for employees and dependents, flexible time off, and paid parental leave of 18 or 12 weeks. It also mentions a remote-first setup with a monthly stipend for coworking, phone, and internet.
Pay source: pay range stated in the source posting. Market data, not an offer from O1DMatch.
Visa path
Senior security researchers often support an O-1A case with evidence such as published research, conference talks, original contributions to the field, vulnerability disclosures, and high-level compensation. The posting states no citizenship restriction. An employer like this or a U.S. agent can file the petition, and approval depends on the individual's evidence.
How to get matched
- Take the free eligibility checkAn AI review of your background against the eight O-1 criteria, at check.o1dmatch.com.
- Create your profile with code WORKWITHUSIt unlocks the Starter plan at no cost. Tell us your field and the work you do today.
- Upload your evidenceEach document is sorted under the criterion it supports, and your criteria map shows what is still missing.
- Get matchedWe match strong profiles with U.S. employers hiring for roles like this one. Gigs you confirm with verified companies count toward your itinerary, and at a score of 75 we connect you with an immigration attorney.
This listing describes a real U.S. posting so you can see what employers ask for. O1DMatch does not represent that employer and does not hold this opening; applying matches you with employers hiring for this kind of role. No visa outcome is promised.