Career profile
Quincy Castro
Chief Information Security Officer (CISO), Chainguard
Security seat record: Chainguard on CISO Tribune
- Current role, per sources checked 12 August 2026
- 28 July 2025
- · Updated
Quincy Castro is the Chief Information Security Officer of Chainguard, appointed in July 2025.
Career path
Castro began his security career at the National Security Agency, where he worked on offensive security operations.
He then moved into private industry, doing security research and reverse-engineering nation-state hacking tools.
Castro went on to lead security as Chief Information Security Officer at GE Transportation, a global transportation and manufacturing company.
He also held a security leadership role at Wabtec Corporation.
Castro then spent four years as Chief Information Security Officer of Redis, the open source software company, before joining Chainguard.
Chainguard, a software supply chain security company, named Castro CISO alongside the appointment of Eyal Bar as Chief Financial Officer and the promotion of Grace Shiell to Vice President of People.
Current remit
As CISO, Castro is responsible for leading Chainguard's security strategy and posture across IT, information security and product security, working with teams across the business, customers and partners to mitigate risk. Chainguard describes his role as heading the company's Security and Technology organization, encompassing IT, corporate security, product security and related functions. Castro earned an MBA from the University of Chicago Booth School of Business in 2020 while running security for a multibillion-dollar manufacturer.
Published work and public comments
Castro writes for Chainguard's Unchained blog, where his posts have covered software supply chain incidents including a LiteLLM package compromise, the keyv and cacheable npm supply chain attack, an AsyncAPI npm compromise, and a takeover of the @mastra npm scope. Describing the stakes of his field, Castro said, "Cybersecurity is the place where really geeky stuff that no one understands turns into a company-killing event in twenty-four hours." He has discussed how security is often treated as a compliance checklist rather than something designed into systems from the outset, and has argued that AI is changing the pace of both attack and defense.
Sources
Mondays, by email
More careers like this, every Monday
One email with the week’s new profiles, each linked to its sources.



