Product Security Governance and Compliance Sr. Analyst

Ciena • Remote-US-CA, CA

1d • $146,000 - $233,200

About The Position

Ciena’s CISO organization is seeking a Senior Governance and Compliance Analyst to help ensure its products meet evolving cybersecurity regulations, industry standards, and customer expectations across global markets. The role analyzes applicable requirements, assesses product compliance, and collaborates with engineering and business teams to address gaps and support entry into new regions. It is suited to an experienced individual contributor who can translate complex regulatory and security requirements into clear, practical actions.

The analyst conducts assessments against Ciena’s Product Security Guidelines (PSG), supports audit readiness, and monitors evolving industry expectations so product teams can prepare for future requirements. The position works with Legal, Product Line Management, R&D, Product Security, engineering, architecture, and product teams to interpret requirements and incorporate them into product capabilities, functional and security non-functional requirements, development controls, roadmaps, designs, testing, release criteria, and evidence. The role also supports governance forums and maintains assessments, compliance records, mappings, templates, and dashboards that show readiness and outstanding risks.

Requirements

• At least 5 years of experience in cybersecurity governance, risk and compliance, product security assurance, security assessments, or a related role.
• Familiarity with global cybersecurity requirements and guidance, including the EU Cyber Resilience Act (CRA), UK Telecommunications (Security) Act (TSA) and associated requirements, India’s Telecom Security Assurance Requirements (ITSAR), CISA Secure by Design guidance, and relevant Australian cybersecurity and telecommunications requirements.
• Ability to distinguish direct product obligations from customer or operator obligations that influence product capabilities and contractual requirements.
• Good understanding of ISO/IEC 27001 and 27002, NIST Cybersecurity Framework, NIST Secure Software Development Framework (SSDF), and other relevant security standards and frameworks.
• Experience conducting control assessments, performing gap analyses, and supporting audit or certification readiness.
• Working knowledge of secure development practices, vulnerability management, product hardening, access controls, logging, software supply chain security, and security updates.
• Ability to translate regulatory language into clear engineering requirements and measurable assessment criteria.
• Experience working with engineering and product management teams to incorporate regulatory and security requirements into product roadmaps, design reviews, development processes, and release criteria.
• Ability to assess regulatory intent and determine effective technical and operational implementation approaches while balancing security, product usability, customer expectations, and business objectives.
• Strong analytical skills, including the ability to identify trends and anticipate future product security expectations.
• Strong documentation, communication, and stakeholder coordination skills, including the ability to explain findings to technical teams and business leaders.
• Bachelor’s or Master’s degree in Cybersecurity, Computer Science, Engineering, or a related field, or equivalent practical experience.

Nice To Haves

• Prior experience in a networking or telecommunications product environment.
• Experience supporting product security certifications, regional market-access assessments, or regulatory readiness programs.
• Familiarity with ETSI security standards, Common Criteria, or other product assurance schemes.
• Relevant certifications such as CISA, CRISC, CISSP, or ISO/IEC 27001 Lead Auditor.

Responsibilities

• Identify and maintain cybersecurity regulatory, certification, and market-access requirements applicable to Ciena products in existing and new regions.
• Partner with Legal, Product Line Management, R&D, and Product Security to interpret regulatory and customer obligations and translate them into actionable capabilities, functional requirements, security NFRs, and development lifecycle controls.
• Assess product readiness for entry into new markets, identifying required security capabilities, certifications, documentation, and compliance milestones.
• Assess products against Product Security Guidelines, security NFRs, regulatory requirements, and internal and pre-audit controls.
• Evaluate control design and implementation through documentation reviews, stakeholder interviews, and examination of technical evidence.
• Identify compliance gaps, document findings and risks, and coordinate remediation plans with owners, priorities, and target dates.
• Track remediation progress, validate closure evidence, and escalate unresolved gaps through governance processes.
• Maintain traceability between external requirements, engineering requirements, security NFRs, internal controls, product capabilities, and assessment evidence.
• Support internal audits, external assessments, and product security certifications by coordinating evidence collection and preparing teams for review.
• Monitor changes in cybersecurity regulations, standards, and industry guidance, and communicate impacts on product development, release, and ongoing support.
• Analyze emerging industry expectations and recommend updates to product roadmaps, security guidelines, and governance processes.
• Develop and maintain assessment templates, control mappings, compliance records, and dashboards showing product readiness and outstanding risks.
• Support Product Security governance forums by presenting assessment results, regulatory developments, and recommended actions.
• Provide practical guidance to engineering, architecture, and product teams on regulatory and customer compliance requirements and their implications for product design, requirements, implementation, testing, and evidence.

Benefits

• Medical, dental, and vision plans.
• Participation in 401(k) (USA) and DCPP (Canada) with company matching.
• Employee Stock Purchase Program (ESPP).
• Employee Assistance Program (EAP).
• Company-paid holidays.
• Paid sick leave and vacation time.
• Paid Family Leave and other leaves of absence in accordance with applicable laws.
• Non-sales employees may be eligible for a discretionary incentive bonus; sales employees may be eligible for sales commission.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior