Information Security Analyst

Overview

An entry-level role for a software engineer to begin or accelerate a career in information security, working within the Information Security and Compliance team on practical cyber security work across security, cyber and compliance disciplines.

What you'll do

• Review application code, architecture, APIs, dependencies and third-party integrations for security weaknesses, and provide clear, practical recommendations.
• Triage findings from static analysis, dependency scanning and related tools, and work with developers to track remediation through to completion.
• Support internal and third-party penetration testing, including scoping, scheduling, supervised web application and API testing, and remediation tracking.
• Run vulnerability scans, assess findings by risk, maintain accurate records and follow up with system owners.
• Complete security assessments for suppliers, software, tools and services, including AI-enabled tools and services connecting to company data.
• Support vendor onboarding, customer security questionnaires, audits and evidence gathering for standards such as ISO 27001 and Cyber Essentials.
• Learn to review security and data protection provisions in customer and supplier contracts, escalating risks to Legal, Procurement and senior security colleagues.
• Coordinate security projects, assessments and questionnaires by tracking owners, actions, risks, deadlines, metrics and status updates.
• Monitor cyber security queues, assist with alert and phishing triage, and support security tooling, user access reviews and awareness initiatives.
• Use scripting and development skills to automate evidence collection, reporting, ticket workflows and data analysis, and build lightweight tools or dashboards.
• Contribute to secure development guidance, security documentation and the continuous improvement of processes and controls.

What you'll need

• 1–2 years of professional experience in software engineering, development or a closely related technical role.
• A bachelor's degree in Computer Science, Software Engineering, Cyber Security or a related field.
• Proficiency in at least one programming or scripting language, such as Python, JavaScript, TypeScript, C#, Java, Go or PowerShell.
• A solid understanding of the software development lifecycle, Git or another version-control system, APIs and web application fundamentals, including HTTP, authentication, authorisation and session management.
• The ability to read code, recognise common insecure patterns and demonstrate awareness of common vulnerability classes such as the OWASP Top 10.
• Strong organisation, attention to detail and the ability to manage multiple priorities, take ownership and escalate concerns appropriately.
• Clear written and verbal communication skills, with the confidence to explain technical risks to both technical and non-technical stakeholders.
• Adaptability, sound judgement, discretion and a collaborative approach when handling sensitive information.

Nice to have

• Hands-on exposure to Burp Suite, capture-the-flag events, bug bounty programmes or personal security projects.
• CI/CD and security scanning tools.
• Azure, GCP, Microsoft 365 or Entra ID.
• Vulnerability management, EDR or third-party risk tools.
• An interest in ISO 27001, Cyber Essentials, GDPR, contracts and risk management.
• Certifications: Security+, CEH, eJPT, PNPT or Burp Suite Certified Practitioner.

Details

• Location: Bengaluru, Karnataka, India.
• Development is planned with your manager and reviewed regularly, with support to work towards relevant professional certifications.