Senior Corporate Security Analyst

About the Role:

We are seeking a highly motivated Senior Corporate Security Analyst to join Toast’s Corporate Security team in Bangalore. This role is focused on hands-on corporate security execution and risk reduction across endpoints, identities, SaaS platforms, vendors, and data — not SOC monitoring or shift-based operations.

The ideal candidate has strong experience working in enterprise corporate security environments, understands how to balance security controls with business needs, and is comfortable partnering with IT, GRC, Procurement, Legal, and Engineering teams. You will own multiple CorpSec programs end-to-end and act as a senior individual contributor, while mentoring junior analysts and helping scale security practices across the organization.

A Day in Life (Responsibilities)

1. Corporate Security Execution & Risk Management

• Own and operate key corporate security controls across endpoint, SaaS, identity, vendor, and data security.
• Perform security risk assessments for business initiatives and translate findings into actionable remediation plans.
• Act as a security advisor to internal stakeholders, focusing on practical risk reduction.

2. Endpoint & SaaS Security

• Lead day-to-day security oversight for corporate endpoints and SaaS applications, including:
• EDR/XDR, device hardening, encryption, MDM/UEM
• Shadow IT discovery and SaaS risk reviews
• Partner with IT Operations and Governance teams to resolve alerts, misconfigurations, and policy gaps.
• Conduct periodic reviews of high-risk applications, browser extensions, and endpoint findings.

3. Vulnerability Management (Corporate Scope)

• Drive vulnerability management for corporate endpoints and internal business systems.
• Triage and prioritize vulnerabilities based on business impact and exploitability.
• Track remediation with IT teams and validate closure.

4. Identity & Access Management (IAM)

• Support enterprise IAM governance, including:
• Joiner / mover / leaver processes
• Access reviews and least-privilege enforcement
• MFA, SSO, device trust, and privileged access (PAM)
• Assist in access investigations and high-risk access exception reviews.

5. Vendor & Third-Party Security

• Conduct vendor security assessments for onboarding and periodic reviews.
• Review SOC 2 reports, security questionnaires, and supporting evidence.
• Track vendor risks, remediation actions, and re-assessments.
• Partner with Procurement, Legal, and GRC teams to ensure security requirements are met.

6. Data Protection & DLP

• Support data protection initiatives across Google Workspace, Slack, and other collaboration platforms.
• Assist with the design, tuning, and enforcement of DLP controls.
• Participate in investigations related to data exposure or misuse.

7. Security Awareness & Process Improvement

• Support security awareness training and phishing simulation programs.
• Maintain CorpSec policies, SOPs, and runbooks.
• Identify opportunities to improve efficiency through automation and tooling.

8. Mentorship & Ownership

• Mentor P2-level security analysts and provide technical guidance.
• Take ownership of CorpSec initiatives and deliver them end-to-end with minimal supervision.

9. Contractor Security Oversight

• Establish and enforce contractor access standards, ensuring strict security controls during onboarding and offboarding.
• Conduct periodic contractor access and activity audits, identifying and mitigating associated risks.

Work Mode: This role follows a hybrid work model, requiring a minimum of 2 days per week in the office.

What We’re Looking For

Required

• 6–10 years of experience in information security with strong corporate security exposure.
• Hands-on experience with:
• Endpoint security and EDR tools (e.g., CrowdStrike)
• Vendor security assessments and SOC 2 reviews
• IAM concepts (Okta, PAM, access reviews)
• SaaS and Shadow IT security
• Strong understanding of security frameworks (NIST CSF, ISO 27001, CIS Controls).
• Experience working closely with IT and governance teams.
• Strong written and verbal communication skills.

Preferred

• Experience with Google Workspace security and DLP.
• Exposure to GRC processes or platforms (ServiceNow GRC, OneTrust).
• Bachelor's degree in Computer Science, Information Security, or a related field; Master's degree preferred.
• Proven experience in developing and implementing security policies, procedures, and frameworks.Demonstrated experience in developing and delivering security awareness training and phishing exercises.
• Possess excellent skills and experience in leveraging AI tools for threat detection, incident response, vulnerability management, and other security functions.
• Familiarity with Google Workspace security features.
• Proficiency with security tools such as Reco.AI, Torq, Splunk, DataDog, bug bounty platforms, Okta Device Trust, BeyondTrust, BeyondCorp, and other SIEM, SOAR and Security tools commonly used in the market.
• Ability to work autonomously and prioritize multiple tasks in a fast-paced environment.
• Excellent verbal and written communication skills, with the ability to effectively communicate technical information to both technical and non-technical audiences. Proven ability to collaborate effectively with cross-functional teams.
• Quick learner and adaptable to new security tools and technologies as they are procured and implemented.
• Ability to adapt to environments, understand requirements, and actively collaborate within the team, with other teams, and with vendors.
• Provide technical guidance and mentorship to P2 security analysts, fostering their professional growth and ensuring alignment with corporate security objectives.
• Take initiative in leading projects and driving security initiatives.
• Relevant security certifications are a plus.