Job highlights

- Qualifications: Bachelors degree in a relevant discipline,or equivalent skilled experience
- Preferred Qualifications

Job Summary Domain analyst covering Application Security, Data Security and Cloud Security, plus ownership of the Design Assurance register. You perform pre-production and BAU reviews for tooling in these domains and maintain the register that assurance coverage is reported from.

About the team.

Design

Assurance and Product Management makes sure security is designed in before anything is built, and that GSK's security capabilities are run as products rather than projects.

Design

Assurance independently verifies that solutions meet the architecture standards set elsewhere in Cyber Architecture and Solutions; it writes none of those standards, and that separation is what makes the review worth anything.

Product

Management owns the security portfolio, vendor governance and investment analytics, and is how GSK manages its managed service vendor as a whole. Platform support engineering moves into this function, with a small internal team retaining oversight while the vendor operates more than 30 platforms and the data fabric under an OTO model. Seventeen roles.

What makes this role different. Three domains plus register ownership, so the role combines review work with a practice-wide responsibility. The register is what assurance coverage and audit evidence are reported from, which means accuracy is not negotiable. You verify against standards the architecture domains set; you do not write them. Appetite to build breadth across AppSec, data and cloud matters more than deep expertise in one.

Key responsibilities

This role will provide you the opportunity to lead key activities to progress your career. These responsibilities include some of the following:

- Perform pre-production reviews for application security tooling including SAST, DAST and SCA, validating against AppSec architecture standards, SDLC integration patterns and API security controls.




- Review data security tooling including DLP and data classification against data security architecture standards.
- Review cloud security tooling and landing-zone configurations against the cloud security standards - CSPM policy baselines, CIEM entitlement boundaries, key management and network isolation across the Azure and GCP estates - and record where a deviation is an accepted exception rather than a gap.
- Keep your review records current in the assurance register, to the evidence standard audit will test.
- Run pre-production and business-as-usual reviews across Application Security, Data Security and Cloud Security, escalating cross-domain and precedent-setting designs to senior review.
- Record each finding against the specific clause of the Application, Data or Cloud security standard it breaches, and track it to evidenced closure.
- Validate vendor-delivered SAST, DAST and SCA toolchain configurations against the secure SDLC integration patterns they were specified to meet.
- Flag recurring findings as candidate standards gaps for escalation to the owning architecture domain.
- Prepare review packs and evidence for governance forums.
- Support audit and regulatory evidence requests from the register.
- Use approved AI tools in your day-to-day work to improve your own productivity and your teams ways of working, sharing what works and applying sound judgement, including validating outputs and following GSK's Responsible AI, privacy and security requirements.

Basic Qualifications

- 10+ years in cyber security - domain focus: Design Assurance for Application Security, Data Security and Cloud Security




- Pre-production design assurance reviews of Application Security, Data Security and Cloud Security tooling
- Reviewing SAST, DAST, SCA, DLP, data classification, CSPM and CIEM configurations against standards
- Owning the assurance register - finding status, SLA tracking and remediation evidence - with review packs and findings documented using automated templates and Critical/High findings escalated
- Reviewing AI application and data security controls - LLM application security, GenAI DLP and AI-SPM configurations

Preferred Qualifications

- SDLC integration and API security controls
- Encryption management and data access governance
- Multi-cloud security control consistency - plus policy-as-code or scripting
- GxP-compliant documentation practice
- Reviewing API security controls and secrets handling in CI/CD pipelines, where the finding is usually in the integration rather than the tool.
- Qualifications: Bachelors degree in a relevant discipline, or equivalent professional experience.
- Typical tools and technologies: SAST, DAST and SCA toolchain review, CSPM and cloud configuration review, DLP and data classification tooling review, API security validation, secure SDLC integration patterns, assurance register ownership, ServiceNow.

Skills

- AI for Cybersecurity

- Application Security

- Cloud Application Security

- Cloud Computing Security

- Cloud Security

- Computer Programming

- Database Security

- Data Security

- Design Assurance

- Identity Access Management (IAM)

- Information Systems

- Infrastructure Security

- ML Security

- Operating Systems Security

- Product Management

- Scripting

- Security Engineering

- Security Technologies

- Security Testing

- Vulnerability Management

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.

📌 Lead Analyst, Design Assurance & Product Management (Bengaluru)
🏢 GSK India
📍 Bengaluru