Product Security Governance and Compliance Sr. Analyst at Ciena

Job description

As the global leader in high-speed connectivity, Ciena builds the critical infrastructure powering the AI era. We’re a technology company shaping the future of networking, guided by innovation, integrity, and collaboration. Through development opportunities, meaningful work, and flexibility, Ciena supports growth and well-being—on and off the job. Connect with a career that matters. Ciena’s CISO organization is looking for a Senior Governance and Compliance Analyst to help ensure our products meet evolving cybersecurity regulations, industry standards, and customer expectations across global markets. You will analyze applicable requirements, assess product compliance, and collaborate with engineering and business teams to address gaps and support entry into new regions. This role is ideal for an experienced individual contributor who can translate complex regulatory and security requirements into clear, practical actions. You will conduct assessments against Ciena’s Product Security Guidelines (PSG), support audit readiness, and monitor evolving industry expectations so product teams can prepare for future requirements. Identify and maintain cybersecurity regulatory, certification, and market access requirements applicable to Ciena’s products across existing and new regions. Partner with Legal, Product Line Management, R&D, and Product Security to determine applicability, interpret regulatory and customer obligations, and translate requirements into actionable capabilities, functional requirements, security non-functional requirements (NFRs), and supporting development lifecycle controls. Assess product readiness for entry into new markets, identifying required security capabilities, certifications, documentation, and compliance milestones. Perform assessments against Ciena’s Product Security Guidelines (PSG), security Non-Functional Requirements (NFRs), regulatory requirements, and other internal and pre-audit controls. Evaluate control design and implementation through documentation reviews, stakeholder interviews, and examination of supporting technical evidence. Identify compliance gaps, document findings and risks, and coordinate remediation plans with clear owners, priorities, and target dates. Track remediation progress, validate closure evidence, and escalate unresolved gaps through established governance processes. Maintain traceability between external requirements, engineering requirements, security NFRs, internal controls, product capabilities, and assessment evidence. Support internal audits, external assessments, and product security certifications by coordinating evidence collection and preparing teams for review. Monitor changes in cybersecurity regulations, standards, and industry guidance, and communicate their impact on product development, release, and ongoing support. Analyze emerging industry expectations and contribute recommendations for updates to product roadmaps, security guidelines, and governance processes. Develop and maintain assessment templates, control mappings, compliance records, and dashboards that provide a clear view of product readiness and outstanding risks. Support Product Security governance forums by presenting assessment results, regulatory developments, and recommended actions. Provide practical guidance to engineering, architecture, and product teams on regulatory and customer compliance requirements, including how those obligations should be reflected in product designs, functional requirements, security NFRs, implementation decisions, testing activities, and supporting evidence. The Must Haves: 5+ years of experience in cybersecurity governance, risk and compliance, product security assurance, security assessments, or a related role. Familiarity with global cybersecurity requirements and guidance, including the EU Cyber Resilience Act (CRA), UK Telecommunications (Security) Act (TSA) and associated requirements, India’s Telecom Security Assurance Requirements (ITSAR), CISA Secur