Opportunity at
DruvaStaff Information Security Analyst - Security Assurance
This full-time, on-site security job focuses on helping prospects and customers feel confident in Druva's data protection, privacy and compliance controls. The Staff Information Security Analyst…
Career Tools
About This Role
This full-time, on-site security job focuses on helping prospects and customers feel confident in Druva's data protection, privacy and compliance controls. The Staff Information Security Analyst supports security due diligence during sales and renewals, runs the company's third-party risk management (TPRM) program, and works to strengthen security habits across the workforce, including resistance to phishing. Much of the day is hands-on: answering customer security questionnaires, supporting customer-led audits, and coordinating…
Job Description
This full-time, on-site security job focuses on helping prospects and customers feel confident in Druva's data protection, privacy and compliance controls. The Staff Information Security Analyst supports security due diligence during sales and renewals, runs the company's third-party risk management (TPRM) program, and works to strengthen security habits across the workforce, including resistance to phishing.
Much of the day is hands-on: answering customer security questionnaires, supporting customer-led audits, and coordinating client-requested penetration tests. The analyst works with the Cyber Defence, Product Security and Compliance groups, along with Engineering, Legal and account teams, to deliver accurate answers on time. The role also keeps customer-facing security policies and the online trust portal current so they match internal controls.
On the vendor side, the position defines how suppliers are assessed and performs security reviews of new and existing vendors. It monitors vulnerabilities and incidents that could reach the supplier base, works to shrink Druva's exposure on internet-facing systems, and designs phishing simulations and training for staff.
The posting favors someone with at least ten years in technology, six or more of them in cybersecurity. Helpful background includes encryption and key management, the MITRE ATT&CK framework, the OWASP Top 10, AWS and Azure security controls, multi-tenant SaaS design, and frameworks such as SOC 2, ISO 27001 and NIST. Experience with third-party risk platforms and workflow automation is also valued.
Responsibilities
- Provide expert internal help with due diligence requests from prospects and customers on security and compliance
- Coordinate responses with internal security teams, Engineering, Legal and account teams
- Handle incoming security questionnaires, customer audit requests and client-requested penetration tests
- Write and upkeep the security policies customers see, plus the online trust portal
- Set the third-party risk management strategy and assess new and existing vendors
- Track vulnerabilities and incidents that affect the vendor landscape
- Reduce risk across the external attack surface
- Design and run phishing simulations and security training for employees
Requirements
- A decade or more working in technology, with six-plus of those years in cybersecurity
- Ability to threat model and judge security risk across linked systems and data flows
- Comfortable partnering with sales, legal and engineering peers
- Clear communication and critical thinking, with a strong sense of ownership and learning
Qualifications
- Working grasp of encryption at rest and in transit (TLS/SSL, PKI, AES) and key management
- Familiarity with MITRE ATT&CK and OWASP Top 10 risks and their countermeasures
- Understanding of AWS and Azure security controls and multi-tenant SaaS architecture
- Familiarity with compliance frameworks such as SOC 2, ISO 27001, HIPAA, CSA STAR, NIST 800-53 and NIST CSF
- Experience with SBOM tooling and questionnaire frameworks such as SIG and CAIQ
- Experience with TPRM platforms (for example KY3P, ProcessUnity, ServiceNow or CyberGRX) and scorecard tools such as SecurityScorecard and Bitsight
- Experience automating workflows and communicating with customers on security matters
Core Skills
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
Where is the role located?
The posting lists the role as on-site but does not name a city or office.
Does the posting state a salary?
No. The posting does not specify salary or benefits.
What experience is required?
The posting asks for at least ten years in technology, preferably six or more in cybersecurity, and a record of partnering with sales, legal and engineering peers.
Is this a full-time job?
Yes. The posting lists the role as full-time.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.