Senior Product Security Governance and Compliance Analyst

Ciena

. Identify and maintain cybersecurity regulatory, certification, and market access requirements applicable to Ciena’s products across existing and new regions .

Posted 10/15/2026full-timeRemote • California • United StatesSenior💰 $146,000 - $233,200 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in cybersecurity governance, risk and compliance, with a strong focus on regulatory requirements and product security assurance. Capable of translating complex regulatory language into actionable engineering requirements and ensuring product readiness for market entry.

Highest-signal resume keywords

Cybersecurity GovernanceRisk And ComplianceSecurity AssessmentsISO/IEC 27001NIST Cybersecurity Framework

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Control AssessmentsGap AnalysesVulnerability ManagementSecure Development PracticesProduct HardeningAccess ControlsLoggingSoftware Supply Chain SecurityRegulatory Requirements TranslationTechnical Implementation Approaches

Soft Skills

Analytical SkillsDocumentation SkillsCommunication SkillsStakeholder Coordination Skills

Certifications & Qualifications

CISACRISCCISSPISO/IEC 27001 Lead Auditor

Industry Keywords

EU Cyber Resilience ActUK Telecommunications ActIndia’s Telecom Security Assurance RequirementsCISA Secure By Design GuidanceETSI Security StandardsCommon Criteria

Tech Stack

Tools & technologies

Cyber Security

About the role

Key responsibilities & impact

Identify and maintain cybersecurity regulatory, certification, and market access requirements applicable to Ciena’s products across existing and new regions
Partner with Legal, Product Line Management, R&D, and Product Security to interpret obligations and translate them into capabilities, functional requirements, security NFRs, and development lifecycle controls
Assess product readiness for entry into new markets
Perform assessments against Product Security Guidelines, security NFRs, regulatory requirements, and internal or pre-audit controls
Evaluate control design and implementation through documentation reviews, stakeholder interviews, and technical evidence examination
Identify compliance gaps, document findings and risks, and coordinate remediation plans
Track remediation progress, validate closure evidence, and escalate unresolved gaps
Maintain traceability between external requirements, engineering requirements, security NFRs, internal controls, product capabilities, and assessment evidence
Support internal audits, external assessments, and product security certifications
Monitor cybersecurity regulations, standards, and industry guidance and communicate impacts on product development, release, and support
Recommend updates to product roadmaps, security guidelines, and governance processes
Develop and maintain assessment templates, control mappings, compliance records, and dashboards
Support Product Security governance forums by presenting assessment results, regulatory developments, and recommended actions
Provide practical compliance guidance to engineering, architecture, and product teams

Requirements

What you’ll need

5+ years of experience in cybersecurity governance, risk and compliance, product security assurance, security assessments, or a related role
Familiarity with global cybersecurity requirements and guidance, including the EU Cyber Resilience Act (CRA), UK Telecommunications (Security) Act (TSA), India’s Telecom Security Assurance Requirements (ITSAR), CISA Secure by Design guidance, and relevant Australian cybersecurity and telecommunications requirements
Ability to distinguish direct product obligations from customer or operator obligations
Understanding of ISO/IEC 27001 and 27002, NIST Cybersecurity Framework, NIST Secure Software Development Framework (SSDF), and other relevant security standards and frameworks
Experience conducting control assessments, gap analyses, and supporting audit or certification readiness
Working knowledge of secure development practices, vulnerability management, product hardening, access controls, logging, software supply chain security, and security updates
Ability to translate regulatory language into engineering requirements and measurable assessment criteria
Experience incorporating regulatory and security requirements into product roadmaps, design reviews, development processes, and release criteria
Ability to assess regulatory intent and determine effective technical and operational implementation approaches
Strong analytical skills
Strong documentation, communication, and stakeholder coordination skills
Bachelor’s or Master’s degree in Cybersecurity, Computer Science, Engineering, or a related field, or equivalent practical experience
Prior networking or telecommunications product experience preferred
Experience supporting product security certifications, regional market access assessments, or regulatory readiness programs preferred
Familiarity with ETSI security standards, Common Criteria, or other product assurance schemes preferred
CISA, CRISC, CISSP, or ISO/IEC 27001 Lead Auditor certification preferred

Benefits

Comp & perks

Discretionary incentive bonus eligibility for non-sales employees
Medical, dental, and vision plans
401(k) (USA) and DCPP (Canada) with company matching
Employee Stock Purchase Program (ESPP)
Employee Assistance Program (EAP)
Company-paid holidays
Paid sick leave
Vacation time
Paid Family Leave and other leaves of absence
Development opportunities
Flexible work arrangements
Accommodation measures for candidates with disabilities