Staff Security Analyst – Governance and Trust

🔥 0 minutes ago

🇺🇸 United States – Remote

💵 $151k - $178k / year

⏰ Full Time

🔴 Lead

🔐 Security Analyst

🦅 H1B Visa Sponsor

This company has sponsored H1B visas in the past.

👻 Ghost score 20%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Chainguard

WebsiteLinkedInAll Job Openings

51 - 200 employees

Founded 2021

🔐 Security

☁️ SaaS

🔒 Cybersecurity

Security • SaaS • Cybersecurity

Chainguard is a company that specializes in building secure container images to enhance software security and compliance. Their products include low-to-zero CVE container images, which are updated daily to maintain security and compliance standards such as FedRAMP, NIST 800-53, PCI-DSS, SOC2, and CIS benchmarks. Chainguard focuses on reducing vulnerabilities, automating compliance, and supporting development workflows without compromising on innovation and productivity. The company serves a wide range of industries, including highly regulated sectors, by providing hardened image solutions to mitigate software supply chain risks and enhance application security.

📋 Description

• Run Chainguard's external examinations end to end, including evidence calendars, population and completeness-and-accuracy requests, sample fulfilment, auditor status calls, and readiness assessments. • Work with the Head of Governance & Trust on scope, control applicability, and auditor negotiation. • Build working relationships with People, IT, Infrastructure, Engineering, Legal, and Sales. • Own customer security diligence, including security questionnaires, customer audits, Trust Center content, and regulated-customer assessments. • Set turnaround expectations with Sales and decide what information to provide. • Own the third-party risk management program, including vendor intake and tiering, assessments, dispositions, and critical-supplier registers and agreements. • Act as product owner for the customer-facing questionnaire responder and vendor-triage agent platform. • Maintain the validated answer bank and evaluate agent output. • Turn recurring questionnaire, audit, and vendor-review patterns into reusable artifacts, self-serve packages, and control improvements. • Work from a unified controls catalog across frameworks. • Produce findings and remediation evidence that survive external re-testing. • Guide the public-sector compliance analyst's work on assessor relationships and federal diligence. • Own compliance and trust reporting outcomes to the CISO, including closures, delays, costs, and protections. • Run retrospectives and drive cross-team corrective actions. • Mentor analysts and help build the team as it grows.

🎯 Requirements

• Senior practitioner experience leading compliance and trust programs. • Experience leading the auditee side of a combined SOC 2 Type 2 and ISO 27001 examination, including populations, sampling, completeness-and-accuracy, auditor relationships, and control applicability or scope questions. • Fluency in regulated-industry customer diligence, including SIG, CAIQ, DORA-style questionnaires, portal-mediated assessments, and customer audits. • Experience running vendor risk assessments at volume within a third-party risk program. • Comfort with evidence as data, query-defined populations, identity, HR, and cloud systems, and policies and controls managed in Git. • Experience with management systems and corrective-action loops. • Experience directing or mentoring junior practitioners and running a queue against metrics. • Ability to build and maintain cross-functional relationships. • Comfort working in an international environment across US, UK, and European teams, customers, auditors, and time zones. • Judgment under examination pressure. • Clear writing for auditors, customers, and executives. • Exposure to US public-sector requirements (FedRAMP, GovRAMP, CMMC) or UK and EU regimes (Cyber Essentials, UK GDPR, EU Cyber Resilience Act, DORA). • Experience migrating a program off a GRC platform, or building answer banks, trust packages, or response automation. • Familiarity with ISO/IEC 42001 or AI governance. • Understanding of software supply chain security concepts: SBOMs, signing, provenance, SLSA. • CISA, ISO 27001 Lead Auditor or Lead Implementer, or equivalent. • No specific educational credential is stated.

🏖️ Benefits

• Flexible & Remote-First Culture: Work remotely with team meetup opportunities, bi-annual destination summits, and a monthly stipend for coworking spaces, phone and internet costs. • Stock options upon hire and promotion. • Participation in secondary offerings. • 10 years to exercise stock options. • 100% covered health, vision and dental insurance premiums for you and your dependents. • ∞ Flexible Time Off. • 18 weeks paid parental leave for birthing parents and 12 weeks for non-birthing parents. • Team meetup opportunities and bi-annual destination summits.