Security Engineer, Chainguard

• 2+ years of experience in information security, GRC, compliance, audit, risk, IT, or a related field; equivalent practical experience is welcome
• Experience supporting audits, control activities, risk assessments, security questionnaires, or compliance programs
• Strong organizational and project coordination skills, with the ability to manage details across multiple workstreams
• Clear written and verbal communication skills, including the ability to explain requests and findings to both technical and non-technical stakeholders
• A structured, detail-oriented approach to documentation, evidence management, and follow-through
• Curiosity about how technology and security controls work, with the confidence to ask questions and investigate unfamiliar topics
• Comfort working with spreadsheets, documentation systems, ticketing tools, and GRC platforms
• An interest in improving repetitive processes through automation, better tooling, or clearer workflows
• A collaborative, team-first approach and the ability to work effectively with colleagues across regions and functions
• Comfort working in a fast-moving environment where priorities and processes continue to evolve
• If your experience is close but doesn't fulfill all requirements, please apply

Desirable

• GRC work is at its best when it makes security clearer, more consistent, and easier to operate
• As a Security Engineer focused on Governance, Risk & Compliance, you’ll help maintain and improve Chainguard’s compliance and risk programs while building the experience and judgment to take on broader ownership over time
• You’ll work closely with experienced security and GRC partners to support SOC 2 Type II and ISO 27001 audit readiness, keep evidence and controls organized, help manage risk and remediation work, and improve the systems and processes behind our compliance program
• This is an earlier-career, hands-on role
• You don’t need to have led an audit or built a GRC function before
• We’re looking for someone with strong organizational habits, good judgment, curiosity, and a willingness to learn
• You’ll have clear areas of responsibility, regular opportunities to work cross-functionally, and support from teammates as you grow your expertise
• Chainguard is building the secure foundation for software development and deployment
• You’ll contribute to that mission by helping our security practices remain effective, measurable, and worthy of our customers’ trust
• Support audit readiness activities for SOC 2 Type II, ISO 27001, and other security assurance initiatives
• Coordinate evidence collection with teams across Security, Engineering, Legal, HR, Product, and other functions
• Help maintain security policies, standards, procedures, control descriptions, and supporting documentation
• Assist with control testing, risk assessments, gap analysis, and remediation tracking
• Keep compliance and risk information accurate and up to date in GRC platforms such as Vanta
• Help translate auditor, customer, and internal security requests into clear next steps for the right stakeholders
• Track action items, follow up on dependencies, and communicate status, risks, and blockers clearly
• Identify opportunities to simplify and improve GRC workflows through better documentation, automation, and use of modern tooling
• Develop and maintain repeatable processes, checklists, runbooks, and evidence-collection practices
• Support customer security reviews, questionnaires, and third-party risk activities as needed
• Learn Chainguard’s systems and security practices well enough to ask useful questions, identify inconsistencies, and escalate potential risks with clear context
• Partner with senior members of the Security and Governance, Risk & Compliance teams on projects that improve Chainguard’s security posture