Lead Analyst, Design Assurance & Product Management - Application Security

Overview

Lead Analyst in GSK's Design Assurance and Product Management function, covering Application Security, Data Security and Cloud Security, and owning the Design Assurance register from which assurance coverage and audit evidence are reported.

What you'll do

• Perform pre-production reviews for application security tooling including SAST, DAST and SCA, validating against AppSec architecture standards, SDLC integration patterns and API security controls.
• Review data security tooling including DLP and data classification against data security architecture standards.
• Review cloud security tooling and landing-zone configurations against the cloud security standards, including CSPM policy baselines, CIEM entitlement boundaries, key management and network isolation across the Azure and GCP estates, and record where a deviation is an accepted exception rather than a gap.
• Keep review records current in the assurance register, to the evidence standard audit will test.
• Run pre-production and business-as-usual reviews across Application Security, Data Security and Cloud Security, escalating cross-domain and precedent-setting designs to senior review.
• Record each finding against the specific clause of the Application, Data or Cloud security standard it breaches, and track it to evidenced closure.
• Validate vendor-delivered SAST, DAST and SCA toolchain configurations against the secure SDLC integration patterns they were specified to meet.
• Flag recurring findings as candidate standards gaps for escalation to the owning architecture domain.
• Prepare review packs and evidence for governance forums.
• Support audit and regulatory evidence requests from the register.
• Use approved AI tools in day-to-day work to improve productivity and team ways of working, validating outputs and following GSK's Responsible AI, privacy and security requirements.

What you'll need

• 10+ years in cyber security, with domain focus on Design Assurance for Application Security, Data Security and Cloud Security.
• Pre-production design assurance reviews of Application Security, Data Security and Cloud Security tooling.
• Reviewing SAST, DAST, SCA, DLP, data classification, CSPM and CIEM configurations against standards.
• Owning the assurance register, including finding status, SLA tracking and remediation evidence, with review packs and findings documented using automated templates and Critical/High findings escalated.
• Reviewing AI application and data security controls, including LLM application security, GenAI DLP and AI-SPM configurations.
• Bachelor's degree in a relevant discipline, or equivalent professional experience.

Nice to have

• SDLC integration and API security controls.
• Encryption management and data access governance.
• Multi-cloud security control consistency, plus policy-as-code or scripting.
• GxP-compliant documentation practice.
• Reviewing API security controls and secrets handling in CI/CD pipelines.

Details

• Location: Bengaluru, Luxor North Tower, India.