Product Security Governance and Compliance Sr. Analyst

As the global leader in high-speed connectivity, Ciena builds the critical infrastructure powering the AI era. We’re a technology company shaping the future of networking, guided by innovation, integrity, and collaboration. Through development opportunities, meaningful work, and flexibility, Ciena supports growth and well-being—on and off the job. Connect with a career that matters.

Ciena’s CISO organization is looking for a Senior Governance and Compliance Analyst to help ensure our products meet evolving cybersecurity regulations, industry standards, and customer expectations across global markets. You will analyze applicable requirements, assess product compliance, and collaborate with engineering and business teams to address gaps and support entry into new regions.

This role is ideal for an experienced individual contributor who can translate complex regulatory and security requirements into clear, practical actions. You will conduct assessments against Ciena’s Product Security Guidelines (PSG), support audit readiness, and monitor evolving industry expectations so product teams can prepare for future requirements.

• Identify and maintain cybersecurity regulatory, certification, and market access requirements applicable to Ciena’s products across existing and new regions.
• Partner with Legal, Product Line Management, R&D, and Product Security to determine applicability, interpret regulatory and customer obligations, and translate requirements into actionable capabilities, functional requirements, security non-functional requirements (NFRs), and supporting development lifecycle controls.
• Assess product readiness for entry into new markets, identifying required security capabilities, certifications, documentation, and compliance milestones.

• Perform assessments against Ciena’s Product Security Guidelines (PSG), security Non-Functional Requirements (NFRs), regulatory requirements, and other internal and pre-audit controls.

• Evaluate control design and implementation through documentation reviews, stakeholder interviews, and examination of supporting technical evidence.
• Identify compliance gaps, document findings and risks, and coordinate remediation plans with clear owners, priorities, and target dates.
• Track remediation progress, validate closure evidence, and escalate unresolved gaps through established governance processes.
• Maintain traceability between external requirements, engineering requirements, security NFRs, internal controls, product capabilities, and assessment evidence.
• Support internal audits, external assessments, and product security certifications by coordinating evidence collection and preparing teams for review.
• Monitor changes in cybersecurity regulations, standards, and industry guidance, and communicate their impact on product development, release, and ongoing support.

• Analyze emerging industry expectations and contribute recommendations for updates to product roadmaps, security guidelines, and governance processes.

• Develop and maintain assessment templates, control mappings, compliance records, and dashboards that provide a clear view of product readiness and outstanding risks.
• Support Product Security governance forums by presenting assessment results, regulatory developments, and recommended actions.
• Provide practical guidance to engineering, architecture, and product teams on regulatory and customer compliance requirements, including how those obligations should be reflected in product designs, functional requirements, security NFRs, implementation decisions, testing activities, and supporting evidence.

The Must Haves:

• 5+ years of experience in cybersecurity governance, risk and compliance, product security assurance, security assessments, or a related role.

• Familiarity with global cybersecurity requirements and guidance, including the EU Cyber Resilience Act (CRA), UK Telecommunications (Security) Act (TSA) and associated requirements, India’s Telecom Security Assurance Requirements (ITSAR), CISA Secure by Design guidance, and relevant Australian cybersecurity and telecommunications requirements.
• Ability to distinguish direct product obligations from customer or operator obligations that influence product capabilities and contractual requirements.
• Good understanding of ISO/IEC 27001 and 27002, NIST Cybersecurity Framework, NIST Secure Software Development Framework (SSDF), and other relevant security standards and frameworks.

• Experience conducting control assessments, performing gap analyses, and supporting audit or certification readiness.

• Working knowledge of secure development practices, vulnerability management, product hardening, access controls, logging, software supply chain security, and security updates.
• Ability to translate regulatory language into clear engineering requirements and measurable assessment criteria.

• Experience working with engineering and product management teams to incorporate regulatory and security requirements into product roadmaps, design reviews, development processes, and release criteria.
• Ability to assess the intent behind regulatory requirements and determine the most effective technical and operational implementation approach while balancing security, product usability, customer expectations, and business objectives

• Strong analytical skills, with the ability to identify trends and anticipate future product security expectations.
• Strong documentation, communication, and stakeholder coordination skills, including the ability to explain findings to technical teams and business leaders.
• Bachelor’s or Master’s degree in Cybersecurity, Computer Science, Engineering, or a related field, or equivalent practical experience.
  

Nice to Haves:

• Prior experience in a networking or telecommunications product environment.
• Experience supporting product security certifications, regional market access assessments, or regulatory readiness programs.
• Familiarity with ETSI security standards, Common Criteria, or other product assurance schemes.
• Relevant certifications such as CISA, CRISC, CISSP, or ISO/IEC 27001 Lead Auditor.

Pay Range: The salary range for this role in California is $146, 000 - $233, 200

Pay ranges at Ciena are designed to accommodate variations in knowledge, skills, experience, market conditions, and locations, reflecting our diverse products, industries, and lines of business. Please note that the pay range information provided in this posting pertains specifically to the primary location, which is the top location listed in case multiple locations are available.

Non-Sales employees may be eligible for a discretionary incentive bonus, while Sales employees may be eligible for a sales commission. In addition to competitive compensation, Ciena offers a comprehensive benefits package, including medical, dental, and vision plans, participation in 401(K) (USA) & DCPP (Canada) with company matching, Employee Stock Purchase Program (ESPP), Employee Assistance Program (EAP), company-paid holidays, paid sick leave, and vacation time. We also comply with all applicable laws regarding Paid Family Leave and other leaves of absence.

At Ciena, we are committed to building and fostering an environment in which our employees feel respected, valued, and heard. Ciena values the diversity of its workforce and respects its employees as individuals. We do not tolerate any form of discrimination.

Ciena is an Equal Opportunity Employer, including disability and protected veteran status.

If contacted in relation to a job opportunity, please advise Ciena of any accommodation measures you may require.

Create an account

Create an account to sign up for job alerts and be notified about new opportunities, customized for you.

Learn more about working at Ciena

Dig deeper into who we are, what we do, and what you can expect as a member of our team.

Discover our people and culture

Meet the people who are shaping the future of communication and explore the culture we’ve built together at CienaLife.

Protect yourself from scams

Only trust communications from official Ciena channels—we will never ask for payment during the recruitment process. Learn more about avoiding recruitment scams.