Senior Security Analyst (Governance and Trust) at Chainguard

Job description

Chainguard is the trusted source for open source. By delivering hardened, secure, and production-ready builds of all the open source software engineers and AI agents rely on, Chainguard helps organizations build faster, stay compliant, and eliminate risk. Our customers include Fortune 500 enterprises and global industry leaders, including Anduril, Canva, Fortinet, Hewlett Packard Enterprise, OpenAI, Snap Inc., and Snowflake. Chainguard is venture-backed by leading investors, including Amplify, IVP, Kleiner Perkins, Lightspeed Venture Partners, Mantis VC, Redpoint Ventures, Sequoia Capital, and Spark Capital. Senior Security Analyst, Governance & Trust Location: US Only The role in a nutshell Chainguard is building the secure foundation for software development and deployment. Our Governance & Trust team helps ensure that the security practices underpinning that mission are effective, measurable, and worthy of our customers' trust. We're looking for a curious, technically minded security practitioner who enjoys solving unfamiliar problems, challenging conventional approaches, and turning complex requirements into practical security capabilities. Your initial focus will be helping Chainguard expand its security assurance capabilities into the U.S. public sector, including our pursuit of FedRAMP 20x and CMMC Level 2. You'll also contribute to the broader Governance & Trust program, supporting activities such as customer security reviews, third-party risk assessments, and other security assurance initiatives. We're a small team with a broad mandate. We collaborate closely, share responsibilities, and use automation and AI to eliminate unnecessary manual work. You'll have meaningful ownership of your initiatives, but you'll also be expected to roll up your sleeves and contribute wherever the team needs you. You don't need a background in federal security or compliance to succeed in this role. We care much more about your security fundamentals, critical thinking, technical curiosity, and ability to learn than your familiarity with any particular framework. This is an opportunity to help build something rather than inherit an established playbook. We're looking for someone who finds that exciting. What you'll do Lead security assurance initiatives supporting Chainguard's expansion into the U.S. public sector, initially focusing on FedRAMP 20x and CMMC Level 2. Research and interpret security requirements, understand the objectives behind them, and translate them into practical, risk-informed recommendations. Work with Engineering, Product Security, and other stakeholders to understand how Chainguard's systems operate, evaluate existing security capabilities, and identify opportunities for improvement. Assess security controls and their effectiveness, distinguishing between requirements that are already satisfied, capabilities that need improvement, and genuine security gaps. Help design scalable approaches to security assurance, favoring continuous validation, automation, and reusable evidence over repetitive manual processes. Drive cross-functional initiatives from initial scoping and requirements analysis through implementation, validation, and ongoing operation. Collaborate with the broader Governance & Trust team to improve how we measure security posture, manage risk, demonstrate assurance, and support business objectives. Communicate complex security requirements and technical findings clearly, providing actionable recommendations to technical teams, business stakeholders, and leadership. Help shape how Chainguard approaches new security and regulatory challenges as our products, customers, and markets evolve. What we're looking for A strong foundation in information security, developed through experience in areas such as security engineering, cloud security, product security, security operations, technical risk management, or security assurance. Technical fluency with modern cloud environments, SaaS architectures, and software