Policy Analyst

Not specified Full-time Not specified Operations

Job Description

Who we are

DigiCert is a global leader in intelligent trust. We protect the digital world by ensuring the security, privacy, and authenticity of every interaction. Our AI-powered DigiCert ONE platform unifies PKI, DNS, and certificate lifecycle management, to secure infrastructure, software, devices, messages, AI content and agents. Learn why more than 100,000 organizations, including 90% of the Fortune 500, choose DigiCert to stop today’s threats and prepare for a quantum-safe future at

Job summary

We are seeking a Policy Analyst to join our Trust team. This role is designed for someone who enjoys untangling complicated requirements and notices when something does not quite add up.

Working across industry standards, laws, regulations, root program policies, audit criteria, and DigiCert’s own Certificate Policies and Certification Practice Statements, you will determine what the requirements say, what they mean in practice, and how DigiCert needs to adhere to them. You won’t spend your day passively summarizing documents. You will be expected to find gaps, challenge assumptions, resolve inconsistencies, and help move policy changes across the finish line.

Working in tandem with compliance, legal, security, product, engineering, validation, PKI operations, audit, and other teams, you will contribute to positions that are accurate, practical, and defensible. You will not always know everything when a question lands on your desk, but you will know how to find the right sources, ask smart questions, and recognize when something doesn’t feel right.

This is policy work that cannot be treated as an academic exercise. A poorly interpreted requirement, an inaccurate CP/CPS statement, or a missed implementation dependency can become an audit finding, a compliance incident, or a certificate problem. The details matter.

This role reports to the Policy and Training Supervisor and is part of DigiCert’s Governance, Risk and Compliance function within the Trust Office.

What you will do

• Analyze applicable laws and regulations in collaboration with Legal and Compliance and translate confirmed legal interpretations into policy and implementation requirements.
• Draft, maintain, and improve Certificate Policies, Certification Practice Statements, internal policies, procedures, standards, and related compliance documentation.
• Assess new and amended requirements, identify what has changed, and determine which policies, systems, controls, processes, and training materials are affected.
• Help establish structured approaches for tracking and resolving policy questions. You may have policy questions with conflicting interpretations and incomplete facts, but you will need to work out what is actually required and keep the decision moving.
• Review proposed policy language for accuracy, consistency, enforceability, and alignment with DigiCert’s actual practices.
• Work with subject‑matter experts to verify that policies accurately reflect technical and operational controls. Validate documented practices through appropriate evidence and consultation with relevant control owners.
• Coordinate policy changes across compliance, legal, security, engineering, product, validation, PKI operations, audit, and other affected teams.
• Track policy decisions, open questions, owners, dependencies, effective dates, implementation commitments, and evidence of compliance.
• Identify and escalation risks before they become problems. You will not have every technical or legal answer yourself, but you should be able to recognize potential compliance, technical, or legal concerns and engage the appropriate subject‑matter experts to fill in the gaps.
• Support internal and external audits by explaining policy requirements, providing supporting documentation, and helping resolve findings.
• Review operational procedures, product requirements, implementation plans, and customer‑facing materials for consistency with applicable policies and standards.
• Communicate complex or unpopular conclusions clearly. You should be able to confidently tell stakeholders that an approach is not compliant without causing panic.
• Participate in standards discussions, policy reviews, incident analysis, remediation activities, and implementation planning.
• Maintain accurate change histories, approval records, effective dates, and traceability between external requirements and internal policy documents.

What you will have

• Bachelor’s degree in law, public policy, compliance, cybersecurity, information systems, technical communication, or related field, or equivalent relevant experience.
• 2+ years of experience in policy analysis, compliance, regulatory analysis, technical writing, cybersecurity governance, or a related area.
• Demonstrated experience interpreting complex requirements and translating them into clear written documentation.
• Experience coordinating work across technical and nontechnical stakeholders.
• Strong analytical skills and the ability to interpret detailed legal, regulatory, technical, and contractual requirements.
• Excellent written and verbal communication skills.
• Proven attention to detail. You notice incorrect cross-references, undefined terms, inconsistent capitalization, unsupported statements, accidental obligations, and the difference between "must" and "may".
• The ability to distinguish between a mandatory requirement, a recommendation, and an accepted practice.
• Sound judgement when requirements are ambiguous, incomplete, or spread across several documents.
• Strong research skills and the discipline to rely on authoritative sources rather than search‑result snippets or institutional folklore.
• Comfort working in technical subject areas and asking informed questions of engineers, security specialists, auditors, lawyers, product managers, and operations teams.
• Comfort with ambiguity and rapid learning. You will not know everything when you begin an assignment, but you will figure it out quickly and ask smart questions.
• Strong organizational skills and the ability to manage several policy changes, reviews, deadlines, and implementation dependencies at once.
• The ability to work independently while knowing when an issue requires legal, technical, compliance, or executive escalation.
• Experience using collaboration and work‑management tools such as Jira, Confluence, GitHub, SharePoint, or similar platforms.
• Health and wellness support, including medical cover (where applicable), gym reimbursements, and mental well‑being resources