Senior Security Analyst (Governance and Trust)

Chainguard builds hardened, secure, production-ready open-source software. The Senior Security Analyst, Governance & Trust will expand security assurance for the U.S. public sector, initially focusing on FedRAMP 20x and CMMC Level 2, and support broader governance, risk, and customer assurance initiatives.

Responsibilities:

• Lead security assurance initiatives supporting Chainguard's expansion into the U.S. public sector, initially focusing on FedRAMP 20x and CMMC Level 2
• Research and interpret security requirements, understand the objectives behind them, and translate them into practical, risk-informed recommendations
• Work with Engineering, Product Security, and other stakeholders to understand how Chainguard's systems operate, evaluate existing security capabilities, and identify opportunities for improvement
• Assess security controls and their effectiveness, distinguishing between requirements that are already satisfied, capabilities that need improvement, and genuine security gaps
• Help design scalable approaches to security assurance, favoring continuous validation, automation, and reusable evidence over repetitive manual processes
• Drive cross-functional initiatives from initial scoping and requirements analysis through implementation, validation, and ongoing operation
• Collaborate with the broader Governance & Trust team to improve how we measure security posture, manage risk, demonstrate assurance, and support business objectives
• Communicate complex security requirements and technical findings clearly, providing actionable recommendations to technical teams, business stakeholders, and leadership
• Help shape how Chainguard approaches new security and regulatory challenges as our products, customers, and markets evolve

Requirements:

• A strong foundation in information security, developed through experience in areas such as security engineering, cloud security, product security, security operations, technical risk management, or security assurance
• Technical fluency with modern cloud environments, SaaS architectures, and software development practices. You don't need to be a software engineer, but you should be comfortable engaging engineers in substantive technical discussions
• Strong analytical and problem-solving skills, including the ability to investigate unfamiliar topics, understand complex requirements, and develop practical solutions
• Sound security judgment and an ability to evaluate whether a control meaningfully addresses risk rather than simply satisfying a documented requirement
• Demonstrated ability to independently lead projects, navigate ambiguity, and work effectively across teams
• An interest in improving how security work gets done, whether through automation, better tooling, simpler processes, or more effective collaboration
• Clear written and verbal communication skills, including the ability to explain technical concepts and security decisions to different audiences
• A collaborative, low-ego approach and a willingness to challenge assumptions, consider different perspectives, and learn from others
• Experience working with security or assurance frameworks such as NIST CSF, NIST SP 800-53, NIST SP 800-171, SOC 2, or ISO 27001
• Exposure to U.S. public-sector security requirements, including FedRAMP, CMMC, or federal contracting environments
• Experience with automated security validation, continuous control monitoring, policy-as-code, GitOps, or evidence automation
• Familiarity with cloud infrastructure, infrastructure-as-code, CI/CD pipelines, or security tooling integrations
• Understanding of software supply chain security concepts such as SBOMs, artifact signing, provenance, or SLSA
• Experience working in a high-growth startup or a security-focused technology company