Staff Security Analyst – Governance and Trust

Chainguard

. Run Chainguard's external examinations end to end, including evidence calendars, population and completeness-and-accuracy requests, sample fulfilment, auditor status calls, and readiness assessments.

Posted 10/27/2026full-timeRemote • United StatesLead💰 $151,000 - $178,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in leading compliance and trust programs, particularly in SOC 2 Type 2 and ISO 27001 examinations, while effectively managing vendor risk assessments and cross-functional relationships. Proficient in producing compliance reports and guiding teams through complex regulatory environments.

Highest-signal resume keywords

SOC 2 Type 2 ExaminationISO 27001 ComplianceVendor Risk AssessmentRegulated-Industry Customer DiligenceCISA Certification

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Compliance Program LeadershipAuditor Relationship ManagementEvidence Data ManagementControl Applicability AssessmentCorrective-Action LoopsQuestionnaire AutomationRisk Management FrameworksSoftware Supply Chain SecurityData QueryingCross-Functional Collaboration

Soft Skills

Judgment Under PressureClear WritingMentoringRelationship BuildingTeam Leadership

Tools & Technologies

GRC PlatformsCloud SystemsGitTrust Center Content ManagementVendor-Triage Agent Platform

Certifications & Qualifications

CISAISO 27001 Lead AuditorISO 27001 Lead Implementer

Industry Keywords

FedRAMPGovRAMPCMMCCyber EssentialsUK GDPREU Cyber Resilience ActDORASIGCAIQISO/IEC 42001

Tech Stack

Tools & technologies

Cloud

About the role

Key responsibilities & impact

Run Chainguard's external examinations end to end, including evidence calendars, population and completeness-and-accuracy requests, sample fulfilment, auditor status calls, and readiness assessments.
Work with the Head of Governance & Trust on scope, control applicability, and auditor negotiation.
Build working relationships with People, IT, Infrastructure, Engineering, Legal, and Sales.
Own customer security diligence, including security questionnaires, customer audits, Trust Center content, and regulated-customer assessments.
Set turnaround expectations with Sales and decide what information to provide.
Own the third-party risk management program, including vendor intake and tiering, assessments, dispositions, and critical-supplier registers and agreements.
Act as product owner for the customer-facing questionnaire responder and vendor-triage agent platform.
Maintain the validated answer bank and evaluate agent output.
Turn recurring questionnaire, audit, and vendor-review patterns into reusable artifacts, self-serve packages, and control improvements.
Work from a unified controls catalog across frameworks.
Produce findings and remediation evidence that survive external re-testing.
Guide the public-sector compliance analyst's work on assessor relationships and federal diligence.
Own compliance and trust reporting outcomes to the CISO, including closures, delays, costs, and protections.
Run retrospectives and drive cross-team corrective actions.
Mentor analysts and help build the team as it grows.

Requirements

What you’ll need

Senior practitioner experience leading compliance and trust programs.
Experience leading the auditee side of a combined SOC 2 Type 2 and ISO 27001 examination, including populations, sampling, completeness-and-accuracy, auditor relationships, and control applicability or scope questions.
Fluency in regulated-industry customer diligence, including SIG, CAIQ, DORA-style questionnaires, portal-mediated assessments, and customer audits.
Experience running vendor risk assessments at volume within a third-party risk program.
Comfort with evidence as data, query-defined populations, identity, HR, and cloud systems, and policies and controls managed in Git.
Experience with management systems and corrective-action loops.
Experience directing or mentoring junior practitioners and running a queue against metrics.
Ability to build and maintain cross-functional relationships.
Comfort working in an international environment across US, UK, and European teams, customers, auditors, and time zones.
Judgment under examination pressure.
Clear writing for auditors, customers, and executives.
Exposure to US public-sector requirements (FedRAMP, GovRAMP, CMMC) or UK and EU regimes (Cyber Essentials, UK GDPR, EU Cyber Resilience Act, DORA).
Experience migrating a program off a GRC platform, or building answer banks, trust packages, or response automation.
Familiarity with ISO/IEC 42001 or AI governance.
Understanding of software supply chain security concepts: SBOMs, signing, provenance, SLSA.
CISA, ISO 27001 Lead Auditor or Lead Implementer, or equivalent.
No specific educational credential is stated.

Benefits

Comp & perks

Flexible & Remote-First Culture: Work remotely with team meetup opportunities, bi-annual destination summits, and a monthly stipend for coworking spaces, phone and internet costs.
Stock options upon hire and promotion.
Participation in secondary offerings.
10 years to exercise stock options.
100% covered health, vision and dental insurance premiums for you and your dependents.
∞ Flexible Time Off.
18 weeks paid parental leave for birthing parents and 12 weeks for non-birthing parents.
Team meetup opportunities and bi-annual destination summits.