Senior Product Security Governance and Compliance Analyst

This is a fully remote position, open to applicants in California.

📋 Description

• Identify and uphold cybersecurity regulatory, certification, and market access obligations relevant to Ciena’s products across both established and emerging regions.

• Collaborate with Legal, Product Line Management, R&D, and Product Security to interpret obligations and convert them into capabilities, functional requirements, security non-functional requirements (NFRs), and development lifecycle controls.

• Evaluate product readiness for entry into new markets.

• Conduct assessments against Product Security Guidelines, security NFRs, regulatory obligations, and internal or pre-audit controls.

• Review control design and implementation through documentation analysis, stakeholder interviews, and examination of technical evidence.

• Identify compliance deficiencies, document findings and risks, and coordinate remediation strategies.

• Monitor remediation progress, verify closure evidence, and escalate any unresolved gaps.

• Maintain traceability between external requirements, engineering specifications, security NFRs, internal controls, product capabilities, and assessment evidence.

• Assist with internal audits, external evaluations, and product security certifications.

• Track cybersecurity regulations, standards, and industry guidelines and communicate their impacts on product development, release, and support.

• Suggest updates to product roadmaps, security guidelines, and governance processes.

• Create and update assessment templates, control mappings, compliance documentation, and dashboards.

• Support Product Security governance forums by presenting assessment outcomes, regulatory updates, and suggested actions.

• Provide actionable compliance guidance to engineering, architecture, and product teams.

⛳️ Requirements

• Over 5 years of experience in cybersecurity governance, risk and compliance, product security assurance, security assessments, or a similar role.

• Knowledge of global cybersecurity requirements and guidelines, including the EU Cyber Resilience Act (CRA), UK Telecommunications (Security) Act (TSA), India’s Telecom Security Assurance Requirements (ITSAR), CISA Secure by Design guidance, and pertinent Australian cybersecurity and telecommunications regulations.

• Ability to differentiate between direct product obligations and those related to customers or operators.

• Familiarity with ISO/IEC 27001 and 27002, NIST Cybersecurity Framework, NIST Secure Software Development Framework (SSDF), and other relevant security standards and frameworks.

• Experience in conducting control assessments, gap analyses, and supporting audit or certification readiness.

• Working knowledge of secure development methodologies, vulnerability management, product hardening, access controls, logging, software supply chain security, and security updates.

• Capability to translate regulatory terminology into engineering requirements and quantifiable assessment criteria.

• Experience in integrating regulatory and security requirements into product roadmaps, design reviews, development processes, and release criteria.

• Ability to interpret regulatory intent and identify effective technical and operational implementation strategies.

• Strong analytical capabilities.

• Excellent documentation, communication, and stakeholder coordination skills.

• Bachelor’s or Master’s degree in Cybersecurity, Computer Science, Engineering, or a related field, or equivalent practical experience.

• Previous experience in networking or telecommunications products is preferred.

• Experience in supporting product security certifications, regional market access evaluations, or regulatory readiness initiatives is preferred.

• Familiarity with ETSI security standards, Common Criteria, or other product assurance frameworks is preferred.

• CISA, CRISC, CISSP, or ISO/IEC 27001 Lead Auditor certification is preferred.

🏝️ Benefits

• Discretionary incentive bonus eligibility for non-sales personnel.

• Medical, dental, and vision insurance plans.

• 401(k) (USA) and DCPP (Canada) with company matching contributions.

• Employee Stock Purchase Program (ESPP).

• Employee Assistance Program (EAP).

• Company-paid holidays.

• Paid sick leave.

• Vacation time.

• Paid Family Leave and other types of leave of absence.

• Opportunities for professional development.

• Flexible work arrangements.

• Accommodations for candidates with disabilities.