Skip to content
CISO Spotlights

Career profile

Quincy Castro

Chief Information Security Officer (CISO), Chainguard

Security seat record: Chainguard on CISO Tribune

Status
Current role, per sources checked 12 August 2026
Appointed
28 July 2025
Published
· Updated

By the CISO Spotlights Desk. Compiled from public records. Each statement below is drawn from the sources listed at the end.

Quincy Castro is the Chief Information Security Officer of Chainguard, appointed in July 2025.

Career path

Castro began his security career at the National Security Agency, where he worked on offensive security operations. He then moved into private industry, doing security research and reverse-engineering nation-state hacking tools. Castro went on to lead security as Chief Information Security Officer at GE Transportation, a global transportation and manufacturing company.
He also held a security leadership role at Wabtec Corporation. Castro then spent four years as Chief Information Security Officer of Redis, the open source software company, before joining Chainguard. Chainguard, a software supply chain security company, named Castro CISO alongside the appointment of Eyal Bar as Chief Financial Officer and the promotion of Grace Shiell to Vice President of People.

Current remit

As CISO, Castro is responsible for leading Chainguard's security strategy and posture across IT, information security and product security, working with teams across the business, customers and partners to mitigate risk. Chainguard describes his role as heading the company's Security and Technology organization, encompassing IT, corporate security, product security and related functions. Castro earned an MBA from the University of Chicago Booth School of Business in 2020 while running security for a multibillion-dollar manufacturer.

Published work and public comments

Castro writes for Chainguard's Unchained blog, where his posts have covered software supply chain incidents including a LiteLLM package compromise, the keyv and cacheable npm supply chain attack, an AsyncAPI npm compromise, and a takeover of the @mastra npm scope. Describing the stakes of his field, Castro said, "Cybersecurity is the place where really geeky stuff that no one understands turns into a company-killing event in twenty-four hours." He has discussed how security is often treated as a compliance checklist rather than something designed into systems from the outset, and has argued that AI is changing the pace of both attack and defense.

Sources

  1. 1.
    SecurityWeeksecurityweek.com · published 28 July 2025 · checked 5 November 2026 · tier B
  2. 2.
    prnewswire.comprnewswire.com · published 30 July 2025 · checked 5 November 2026 · tier A
  3. 3.
    chainguard.devchainguard.dev · undated page · checked 5 November 2026 · tier A
  4. 4.
    The University of Chicago Booth School of Businesschicagobooth.edu · published 12 August 2026 · checked 5 November 2026 · tier A

Tier A: the organization itself, a regulator or a government page. Tier B: established trade or business press.

Mondays, by email

More careers like this, every Monday

One email with the week’s new profiles, each linked to its sources.

Unsubscribe any time.