Staff Security Analyst – Governance and Trust

This is a fully remote position, open to applicants in United States.

📋 Description

• Oversee the complete external examination process at Chainguard, which includes managing evidence calendars, handling population and completeness-and-accuracy requests, fulfilling samples, coordinating auditor status calls, and conducting readiness assessments.

• Collaborate with the Head of Governance & Trust to define scope, determine control applicability, and negotiate with auditors.

• Cultivate productive relationships with teams in People, IT, Infrastructure, Engineering, Legal, and Sales.

• Take charge of customer security diligence, which encompasses security questionnaires, customer audits, Trust Center content, and assessments for regulated customers.

• Establish turnaround expectations with the Sales team and determine what information to share.

• Lead the third-party risk management initiative, which includes vendor intake and tiering, conducting assessments, making dispositions, and managing critical-supplier registers and agreements.

• Serve as the product owner for the customer-facing questionnaire responder and vendor-triage agent platform.

• Maintain and update the validated answer bank, while assessing agent outputs.

• Transform recurring questionnaire, audit, and vendor review patterns into reusable artifacts, self-service packages, and control enhancements.

• Operate from a unified controls catalog that spans various frameworks.

• Generate findings and remediation evidence that withstands external re-testing.

• Supervise the public-sector compliance analyst's efforts related to assessor relationships and federal diligence.

• Manage compliance and trust reporting outcomes for the CISO, including tracking closures, delays, costs, and protections.

• Facilitate retrospectives and promote cross-team corrective actions.

• Mentor analysts and assist in team development as it expands.

⛳️ Requirements

• Proven senior practitioner experience in leading compliance and trust initiatives.

• Experience managing the auditee side of a combined SOC 2 Type 2 and ISO 27001 examination, covering aspects like populations, sampling, completeness-and-accuracy, auditor relationships, and questions regarding control applicability or scope.

• Proficient in regulated-industry customer diligence, including SIG, CAIQ, DORA-style questionnaires, portal-mediated assessments, and customer audits.

• Demonstrated experience conducting vendor risk assessments at scale within a third-party risk management program.

• Comfortable handling evidence as data, including query-defined populations, identity, HR, and cloud systems, as well as policies and controls managed in Git.

• Familiar with management systems and corrective-action processes.

• Experience in directing or mentoring junior practitioners while managing a queue based on metrics.

• Strong ability to build and sustain cross-functional relationships.

• Comfortable working in an international setting that includes teams, customers, auditors, and time zones across the US, UK, and Europe.

• Good judgment when under examination pressure.

• Excellent written communication skills for auditors, customers, and executives.

• Familiarity with US public-sector requirements (FedRAMP, GovRAMP, CMMC) as well as UK and EU regulations (Cyber Essentials, UK GDPR, EU Cyber Resilience Act, DORA).

• Experience transitioning a program off a GRC platform, or developing answer banks, trust packages, or response automation.

• Knowledge of ISO/IEC 42001 or AI governance.

• Understanding of software supply chain security concepts such as SBOMs, signing, provenance, and SLSA.

• Relevant certifications like CISA, ISO 27001 Lead Auditor or Lead Implementer, or equivalent qualifications.

• No specific educational credentials are required.

🏝️ Benefits

• Flexible & Remote-First Culture: Enjoy the option to work remotely with opportunities for team meetups, bi-annual destination summits, and a monthly stipend for coworking spaces, phone, and internet expenses.

• Stock options available upon hire and promotion.

• Eligibility for participation in secondary offerings.

• A ten-year period to exercise stock options.

• Health, vision, and dental insurance premiums fully covered for you and your dependents.

• Unlimited Flexible Time Off.

• Paid parental leave of 18 weeks for birthing parents and 12 weeks for non-birthing parents.

• Opportunities for team meetups and bi-annual destination summits.