Staff Security Analyst (Governance and Trust)

Chainguard

9d • $151,000 - $178,000 • Remote

About The Position

Chainguard is hiring a senior practitioner for the compliance and trust side of its Governance & Trust team. The role leads execution of external examinations, including SOC 2, ISO 27001, Cyber Essentials, and additional sector and regional certifications; owns customer security diligence and third-party risk operations; and helps shape the team's customer-facing security and compliance work. The role is expected to formally manage the group as it grows, which currently includes a public-sector compliance analyst and two customer-facing security analysts.

This is not a checklist compliance position. Chainguard treats policies and controls as code, sources evidence from systems of record instead of screenshots, and uses AI agents for initial questionnaire responses and vendor triage. The person in this role defines what those systems should produce, validates their output, and represents the results to auditors and customers.

The role works across People, IT, Infrastructure, Engineering, Legal, and Sales, and partners with the Head of Governance & Trust on examination scope, control applicability, and auditor discussions. It also owns reporting outcomes for the compliance and trust sections of the function's CISO reporting and helps build the team as it grows.

Chainguard's customers are increasingly regulated, with more demanding diligence requirements. This role determines how the company responds and ensures its answers withstand auditor testing. The position offers the opportunity to build the compliance and trust capability of a security company whose product is trust.

Requirements

• Write clearly for auditors, customers, and executives.
• Exercise sound judgment under examination pressure, including knowing when to challenge, concede, withdraw stale artifacts, or escalate.
• Build and maintain cross-functional relationships; the role depends on evidence, populations, and remediation residing in other teams.
• Be comfortable working in an international environment with a distributed team across the US, UK, and Europe, and with customers and auditors across time zones.

Nice To Haves

• Have led the auditee side of a combined SOC 2 Type 2 and ISO 27001 examination, including running populations, sampling, completeness-and-accuracy, and the auditor relationship, and have experience debating control applicability or scope with an auditor.
• Be fluent in regulated-industry customer diligence, including SIG, CAIQ, DORA-style questionnaires, portal-mediated assessments, and customer audits; understand the commercial stakes and have held the line with Sales without losing a deal.
• Have run high-volume vendor risk assessments within a third-party risk program and be able to distinguish dispositions from matters that should be escalated.
• Treat evidence as data; be comfortable with query-defined populations, evidence from identity, HR, and cloud systems, and policies and controls managed in Git. Coding is not required, but a system-based approach is preferred over screenshots.
• Have worked within a management system with a functioning corrective-action loop and understand the difference between completing an action and making a control effective.
• Have directed or mentored junior practitioners, run a queue against metrics, and want to lead a team.
• Be comfortable with UK and EU regimes alongside US ones in an international environment.
• Have exposure to US public-sector requirements such as FedRAMP, GovRAMP, or CMMC, or UK and EU regimes such as Cyber Essentials, UK GDPR, the EU Cyber Resilience Act, or DORA.
• Have experience migrating a program off a GRC platform, or building answer banks, trust packages, or response automation.
• Have familiarity with ISO/IEC 42001 or AI governance.
• Understand software supply chain security concepts such as SBOMs, signing, provenance, and SLSA.
• Hold CISA, ISO 27001 Lead Auditor or Lead Implementer certification, or an equivalent qualification.

Responsibilities

• Run external examinations end to end, including the evidence calendar, population and completeness-and-accuracy requests, sample fulfilment, auditor status calls, and readiness assessments.
• Work with the Head of Governance & Trust on examination scope, control applicability, and auditor negotiation.
• Build and maintain working relationships with People, IT, Infrastructure, Engineering, Legal, and Sales to support evidence collection, populations, and remediation.
• Own customer security diligence, including security questionnaires, customer audits, Trust Center content, and multi-round assessments for regulated customers.
• Set achievable turnaround expectations with Sales and determine what information the team will provide to customers.
• Own third-party risk management, including vendor intake and tiering, assessments, dispositions, and the register of critical suppliers and their agreements.
• Act as product owner for the customer-facing side of the agent platform: define requirements for questionnaire responder and vendor triage agents, maintain their validated answer bank, and assess whether their output is suitable to send.
• Monitor approaches to diligence and response automation at other companies and bring in better approaches when available.
• Turn recurring questionnaire, audit, and vendor review patterns into standing artifacts, self-serve packages, and control improvements.
• Use a unified controls catalog across frameworks and raise mapping and implementation defects with the governance side rather than maintaining framework-specific lists.
• Produce findings and remediation evidence that withstand external re-testing, and contribute root causes to the corrective-action process.
• Guide the public-sector compliance analyst's work on assessor relationships and customer-facing federal diligence; technical scoping decisions remain with the Head of Governance & Trust.
• Own the outcomes described in compliance and trust reporting to the CISO, including what closed, what slipped, the cost, and what was protected.
• Run retrospectives when work slips and drive resulting cross-team actions.
• Mentor team analysts, exchange feedback, and help build the team as it grows.

Benefits

• Remote-first culture with team meetup opportunities, bi-annual destination summits, and a monthly stipend for coworking spaces, phone, and internet costs.
• Stock options upon hire and promotion, participation in secondary offerings, and 10 years to exercise options.
• 100% coverage of health, vision, and dental insurance premiums for employees and their dependents.
• Flexible time off.
• Paid parental leave: 18 weeks for birthing parents and 12 weeks for non-birthing parents, with the option to use it all at once or throughout the child's first year.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed