Staff Security Analyst, Governance and Trust

Chainguard is the trusted source for open source, delivering hardened, secure and production-ready builds of open source software. The Governance & Trust team ensures the security practices behind that mission are effective, measurable and worthy of customers' trust. This role leads the compliance and trust side of that team, running external examinations (SOC 2, ISO 27001, Cyber Essentials and other certifications), owning customer security diligence, running third-party risk operations, and leading the team's compliance and trust analysts. The operating model treats policies and controls as code, draws evidence from systems of record rather than screenshots, and uses AI agents for first-pass questionnaire responses and vendor triage.

Responsibilities

Run the execution of external examinations end to end (evidence calendar, populations, completeness-and-accuracy requests, sample fulfilment, auditor status calls, readiness assessment); Work with the Head of Governance & Trust on scope, control applicability and auditor negotiation; Build and maintain working relationships with People, IT, Infrastructure, Engineering, Legal and Sales; Own customer security diligence (security questionnaires, customer audits, Trust Center content, multi-round assessments); Set turnaround expectations with Sales and decide what will and won't be provided; Own the third-party risk management program (vendor intake and tiering, assessments, dispositions, register of critical suppliers); Act as product owner for the customer-facing side of the agent platform (questionnaire responder and vendor triage agents, validated answer bank); Turn recurring patterns into standing artifacts, self-serve packages and control improvements; Work from a single unified controls catalog across frameworks; Produce findings and remediation evidence that survive external re-test and feed root causes into corrective action; Guide the public-sector compliance analyst's work on assessor relationships and federal diligence; Own the compliance and trust outcomes in the function's reporting to the CISO and run retrospectives when work slips; Mentor analysts and help build the team as it grows

Requirements

Senior practitioner to lead the compliance and trust side of the Governance & Trust team; Formal management of the compliance and trust group as the team grows

Nice to have

Lead on the auditee side of a combined SOC 2 Type 2 and ISO 27001 examination; Fluency in regulated-industry customer diligence (SIG, CAIQ, DORA-style questionnaires, portal-mediated assessments, customer audits); Experience running vendor risk assessments at volume within a third-party risk program; Treating evidence as data (populations defined by query, evidence from identity, HR and cloud systems, policies and controls managed in Git); Experience inside a management system with a functioning corrective-action loop; Experience directing or mentoring junior practitioners and running a queue against metrics; Strong cross-functional relationship building; Comfort working in an international environment (US, UK, Europe); Judgment under examination pressure; Clear writing for auditors, customers and executives; Exposure to US public-sector requirements (FedRAMP, GovRAMP, CMMC) or UK and EU regimes (Cyber Essentials, UK GDPR, EU Cyber Resilience Act, DORA); Experience migrating a program off a GRC platform or building answer banks, trust packages or response automation; Familiarity with ISO/IEC 42001 or AI governance; Understanding of software supply chain security (SBOMs, signing, provenance, SLSA); CISA, ISO 27001 Lead Auditor or Lead Implementer, or equivalent

Benefits

Flexible and remote-first culture with team meetups and bi-annual destination summits; Monthly stipend for coworking spaces, phone and internet costs; Stock options upon hire and promotion, with participation in secondary offerings and 10 years to exercise; 100% covered health, vision and dental insurance premiums for employee and dependents; Flexible time off; 18 weeks paid parental leave for birthing parents and 12 weeks for non-birthing parents