Senior Corporate Security Analyst
Toast · Bengaluru, Karnataka, India
- On site
- Full-time
- $120,000 / year
- Bengaluru, Karnataka, India
Job highlights
- Lead corporate security execution and risk reduction.
- Own and operate security controls for endpoints, SaaS, identities.
- Drive vulnerability management and IAM governance.
- Conduct vendor security assessments and data protection initiatives.
- Mentor junior analysts and improve security practices.
About the role
About the Role:
We are seeking a highly motivated Senior Corporate Security Analyst to join Toast’s Corporate Security team in Bangalore. This role is focused on hands-on corporate security execution and risk reduction across endpoints, identities, SaaS platforms, vendors, and data — not SOC monitoring or shift-based operations.
The ideal candidate has strong experience working in enterprise corporate security environments, understands how to balance security controls with business needs, and is comfortable partnering with IT, GRC, Procurement, Legal, and Engineering teams. You will own multiple CorpSec programs end-to-end and act as a senior individual contributor, while mentoring junior analysts and helping scale security practices across the organization.
A Day in Life (Responsibilities)
Corporate Security Execution & Risk Management
- Own and operate key corporate security controls across endpoint, SaaS, identity, vendor, and data security.
- Perform security risk assessments for business initiatives and translate findings into actionable remediation plans.
- Act as a security advisor to internal stakeholders, focusing on practical risk reduction.
Endpoint & SaaS Security
- Lead day-to-day security oversight for corporate endpoints and SaaS applications, including: EDR/XDR, device hardening, encryption, MDM/UEM, Shadow IT discovery and SaaS risk reviews.
- Partner with IT Operations and Governance teams to resolve alerts, misconfigurations, and policy gaps.
- Conduct periodic reviews of high-risk applications, browser extensions, and endpoint findings.
Vulnerability Management (Corporate Scope)
- Drive vulnerability management for corporate endpoints and internal business systems.
- Triage and prioritize vulnerabilities based on business impact and exploitability.
- Track remediation with IT teams and validate closure.
Identity & Access Management (IAM)
- Support enterprise IAM governance, including: Joiner / mover / leaver processes, Access reviews and least-privilege enforcement, MFA, SSO, device trust, and privileged access (PAM).
- Assist in access investigations and high-risk access exception reviews.
Vendor & Third-Party Security
- Conduct vendor security assessments for onboarding and periodic reviews.
- Review SOC 2 reports, security questionnaires, and supporting evidence.
- Track vendor risks, remediation actions, and re-assessments.
- Partner with Procurement, Legal, and GRC teams to ensure security requirements are met.
Data Protection & DLP
- Support data protection initiatives across Google Workspace, Slack, and other collaboration platforms.
- Assist with the design, tuning, and enforcement of DLP controls.
- Participate in investigations related to data exposure or misuse.
Security Awareness & Process Improvement
- Support security awareness training and phishing simulation programs.
- Maintain CorpSec policies, SOPs, and runbooks.
- Identify opportunities to improve efficiency through automation and tooling.
Mentorship & Ownership
- Mentor P2-level security analysts and provide technical guidance.
- Take ownership of CorpSec initiatives and deliver them end-to-end with minimal supervision.
Contractor Security Oversight
- Establish and enforce contractor access standards, ensuring strict security controls during onboarding and offboarding.
- Conduct periodic contractor access and activity audits, identifying and mitigating associated risks.
Work Mode:
This role follows a hybrid work model, requiring a minimum of 2 days per week in the office.
What We’re Looking For (Required)
- 6–10 years of experience in information security with strong corporate security exposure.
- Hands-on experience with: Endpoint security and EDR tools (e.g., CrowdStrike), Vendor security assessments and SOC 2 reviews, IAM concepts (Okta, PAM, access reviews), SaaS and Shadow IT security.
- Strong understanding of security frameworks (NIST CSF, ISO 27001, CIS Controls).
- Experience working closely with IT and governance teams.
- Strong written and verbal communication skills.
Preferred Qualifications
- Experience with Google Workspace security and DLP.
- Exposure to GRC processes or platforms (ServiceNow GRC, OneTrust).
- Bachelor's degree in Computer Science, Information Security, or a related field; Master's degree preferred.
- Proven experience in developing and implementing security policies, procedures, and frameworks.
- Demonstrated experience in developing and delivering security awareness training and phishing exercises.
- Possess excellent skills and experience in leveraging AI tools for threat detection, incident response, vulnerability management, and other security functions.
- Familiarity with Google Workspace security features.
- Proficiency with security tools such as Reco.AI, Torq, Splunk, DataDog, bug bounty platforms, Okta Device Trust, BeyondTrust, BeyondCorp, and other SIEM, SOAR and Security tools commonly used in the market.
- Ability to work autonomously and prioritize multiple tasks in a fast-paced environment.
- Excellent verbal and written communication skills, with the ability to effectively communicate technical information to both technical and non-technical audiences.
- Proven ability to collaborate effectively with cross-functional teams.
- Quick learner and adaptable to new security tools and technologies as they are procured and implemented.
- Ability to adapt to environments, understand requirements, and actively collaborate within the team, with other teams, and with vendors.
- Provide technical guidance and mentorship to P2 security analysts, fostering their professional growth and ensuring alignment with corporate security objectives.
- Take initiative in leading projects and driving security initiatives.
- Relevant security certifications are a plus.
How Toast Uses AI In Its Hiring Process
Throughout the hiring process, our goal is to get to know you. We use AI tools to support our recruiters and interviewers with tasks like note-taking, summarization, and documentation of interviews to ensure they can be fully focused on your conversation. All hiring decisions are made by people.
Diversity, Equity, and Inclusion is Baked into our Recipe for Success
At Toast, our employees are our secret ingredient—when they thrive, we thrive. The restaurant industry is one of the most diverse, and we embrace that diversity with authenticity, inclusivity, respect, and humility. By embedding these principles into our culture and design, we create equitable opportunities for all and raise the bar in delivering exceptional experiences.
We Thrive Together
We embrace a hybrid work model that fosters in-person collaboration while valuing individual needs. Our goal is to build a strong culture of connection as we work together to empower the restaurant community. To learn more about how we work globally and regionally, check out: https://careers.toasttab.com/locations-toast.
Apply today!
Toast is committed to creating an accessible and inclusive hiring process. As part of this commitment, we strive to provide reasonable accommodations for persons with disabilities to enable them to access the hiring process. If you need an accommodation to access the job application or interview process, please contact candidateaccommodations@toasttab.com.
For roles in the United States, it is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability.
Key skills/competency
- Senior Corporate Security Analyst
- Endpoint Security
- SaaS Security
- Identity and Access Management (IAM)
- Vendor Security Assessments
- Vulnerability Management
- Data Protection
- Security Awareness
- Risk Management
- Process Improvement
Skills & topics
- Senior Corporate Security Analyst
- Corporate Security
- Endpoint Security
- SaaS Security
- Identity and Access Management
- IAM
- Vendor Security
- Vulnerability Management
- Data Protection
- DLP
- Risk Management
- Information Security
- CrowdStrike
- Okta
- NIST CSF
- ISO 27001
- CIS Controls
- GRC
- SIEM
- SOAR
- Bangalore
How to get hired
- Customize your resume: Highlight 6-10 years of information security experience, focusing on corporate security, endpoint, SaaS, IAM, and vendor assessments.
- Tailor your application: Emphasize your experience with security frameworks like NIST CSF and your collaborative skills with IT and governance teams.
- Prepare for interviews: Be ready to discuss hands-on experience with EDR tools (CrowdStrike), IAM concepts (Okta), and vendor assessment processes.
- Showcase initiative: Demonstrate your ability to own programs end-to-end, mentor junior analysts, and drive security improvements.
- Highlight relevant skills: Mention any experience with Google Workspace security, DLP, GRC platforms, or AI security tools.
Technical preparation
Behavioral questions
Frequently asked questions
- What are the key responsibilities for a Senior Corporate Security Analyst at Toast?
- The Senior Corporate Security Analyst at Toast is responsible for hands-on corporate security execution and risk reduction across endpoints, identities, SaaS platforms, vendors, and data. This includes owning security controls, performing risk assessments, leading vulnerability management, supporting IAM governance, conducting vendor assessments, and contributing to data protection initiatives. The role also involves mentoring junior analysts and improving security practices.
- What experience is required for the Senior Corporate Security Analyst role at Toast?
- The required experience includes 6-10 years in information security with strong corporate security exposure. Hands-on experience with endpoint security and EDR tools (like CrowdStrike), vendor security assessments and SOC 2 reviews, IAM concepts (Okta, PAM, access reviews), and SaaS/Shadow IT security is essential. A strong understanding of security frameworks (NIST CSF, ISO 27001, CIS Controls) and experience collaborating with IT and governance teams are also required.
- What is the work arrangement for the Senior Corporate Security Analyst position at Toast?
- This role follows a hybrid work model, requiring a minimum of 2 days per week in the office. This allows for a blend of in-person collaboration and flexibility.
- Does Toast use AI in their hiring process for the Senior Corporate Security Analyst role?
- Yes, Toast uses AI tools to support recruiters and interviewers with tasks like note-taking, summarization, and documentation during the hiring process. This allows them to focus more on the candidate's conversation. However, all hiring decisions are made by people.
- What are the preferred qualifications for a Senior Corporate Security Analyst at Toast?
- Preferred qualifications include experience with Google Workspace security and DLP, exposure to GRC processes or platforms, a Bachelor's degree in Computer Science or a related field (Master's preferred), experience developing security policies and awareness training, and familiarity with AI tools for security functions. Proficiency with various security tools like Reco.AI, Torq, Splunk, and Okta Device Trust is also beneficial.
- What kind of mentorship is expected from a Senior Corporate Security Analyst at Toast?
- The Senior Corporate Security Analyst is expected to mentor P2-level security analysts, providing technical guidance and fostering their professional growth. This includes ensuring alignment with corporate security objectives and helping them develop their skills.