Senior Security Analyst (Governance and Trust)

Responsibilities

• Design and operate a continuous monitoring and continuous authorization capability built to be portable across frameworks, so it transfers cleanly if FedRAMP 20x, IRAP, C5, or other regimes come into scope, rather than being rebuilt from scratch each time.
• Translate CMMC 2.0, FedRAMP 20x, and other public-sector requirements into practical controls, evidence pipelines, and decision-ready recommendations, prioritized by what actually reduces risk over what merely satisfies an assessor.
• Partner with Engineering and Product Security to connect federal requirements to how Chainguard's cloud-native systems and Athena actually work.
• Support Chainguard's pursuit of a Facility Clearance (FCL), including the internal governance that comes with it.
• Build scalable systems for control ownership, evidence collection, remediation tracking, exceptions, and reporting, favoring automation and policy-as-code over manual processes.
• Coordinate across Security, Federal strategy, Go-to-Market, Product, Engineering, and Legal to keep federal program work moving, escalating legal or regulatory interpretation questions rather than freelancing them.
• Provide risk-based, technically grounded recommendations on federal security questions and program tradeoffs, and be willing to say when a technically-compliant answer doesn't actually reduce risk.
• Create documentation that helps technical and non-technical partners understand what's required, why it matters, and what to do next.
• Help make governance and trust a scalable quantity as Chainguard grows.
• Build the public sector security program that will help Chainguard earn and maintain trust with government customers.

Languages