CSA Security Analyst

cloud software group • San Ramon, CA

9d • $111,405 - $190,502

About The Position

The CSA Security Analyst supports Cloud Software Group’s Customer Security Assurance (CSA) program by managing customer security due diligence for new, renewing, and existing customers. This customer-facing role handles security questionnaires, due-diligence requests, customer calls, audits, assessments, and security requirements in RFPs and contracts. The analyst explains Cloud SG’s security posture, architecture, controls, policies, certifications, risk management practices, and security operations to technical and non-technical audiences, ensuring responses are accurate, complete, approved, and consistent with the company’s implementations and commitments.

The analyst works with Sales and Account teams, Product, Engineering, Corporate Security, GRC, Legal, Privacy, IT, Support, HR, Finance, and other stakeholders. The role evaluates customer requests against technical and operational controls, identifies risks and exceptions, coordinates evidence and remediation, and helps review security provisions in contracts and related documents. It also identifies recurring customer needs, emerging regulatory expectations, security trends, and documentation gaps to develop scalable Trust Center content, standard responses, knowledge articles, process improvements, and automation opportunities.

Requirements

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Risk Management, Business, or equivalent experience.
• At least 5 years of experience in cybersecurity, GRC, security engineering, compliance, IT risk, audit, or equivalent experience.
• Customer Security and Trust experience in a complex, multi-product cloud or SaaS corporation, or equivalent Third-Party/Vendor IT Risk Management experience.
• Experience working with Sales and/or in a customer-facing capacity representing company security posture and controls across industry requirements.
• Knowledge of current, new, and upcoming regulations such as GDPR, DORA, CRA, and the EU AI Act.
• Demonstrated experience working with technical and security teams in a technology, SaaS, cloud, or enterprise environment.
• Strong understanding of cybersecurity principles, security controls, risk management, and compliance frameworks.
• Practical experience with one or more frameworks such as ISO 27001, SOC 2, NIST, PCI DSS, FedRAMP, CMMC, ISO 42001, ISO 27701, HIPAA, or similar standards.
• Ability to understand technical architecture, security controls, system configurations, and engineering processes sufficiently to evaluate compliance and risk.
• Strong analytical and problem-solving skills, including the ability to investigate complex issues, determine root cause, and define appropriate solutions.
• Excellent written and verbal communication skills.
• Demonstrated ability to build strong relationships and influence stakeholders across technical and business functions.
• Ability to act as a trusted advisor, helping stakeholders understand the intent behind security and compliance requirements.

Nice To Haves

• Professional certification such as CISA, CRISC, CISSP, ISO 27001 Lead Auditor/Implementer, or equivalent.
• Experience with Loopio, Archer, ServiceNow, or similar platforms.
• Experience supporting customer security questionnaires and security assurance activities.
• Familiarity with SIG Core and SIG Lite questionnaires and their requirements.
• Experience working with external regulators, certification bodies, customers, or regulatory assessors.

Responsibilities

• Own assigned Customer Security Assurance requests from intake through completion, ensuring responses are accurate, timely, complete, and appropriately approved.
• Manage and respond to customer security questionnaires, due-diligence requests, RFP/RFI security requirements, customer assessments, and annual security reviews.
• Serve as the primary Security subject-matter expert for assigned customer engagements and represent Cloud SG’s security posture professionally.
• Participate in customer security calls, technical discussions, security briefings, due-diligence meetings, and customer audits.
• Explain Cloud SG’s security architecture, controls, policies, certifications, risk management practices, and security operations to technical and non-technical audiences.
• Analyze customer questions to identify the underlying security or compliance control requirement and research complex or ambiguous requirements with internal subject-matter experts.
• Ensure customer responses align with Cloud SG policies, technical implementations, certifications, regulatory obligations, contractual commitments, and approved security positions.
• Challenge incomplete, inconsistent, technically unsupported responses or responses that could create unintended security or contractual commitments.
• Identify requirements outside Cloud SG’s standard security posture and escalate them for appropriate Security, Legal, Product, GRC, or Executive review.
• Develop a working understanding of Cloud SG’s cloud, SaaS, infrastructure, application, identity, endpoint, network, data protection, monitoring, vulnerability management, incident response, and secure development environments.
• Evaluate customer security questions against Cloud SG’s technical and operational controls, and work with Security, Product, and Engineering experts to validate responses.
• Identify potential security gaps, control deficiencies, architectural concerns, and exceptions raised through customer due diligence.
• Assess customer-specific requirements, determine whether they are covered by existing controls or processes, require evidence or clarification, require risk acceptance or exception management, or require remediation.
• Translate technical security issues into business and customer impact, recognize requirements that could create broader precedent, and support risk-based decision-making.
• Apply practical knowledge of cybersecurity and compliance frameworks, map customer requirements to Cloud SG’s compliance certifications and controls, and maintain awareness of emerging cybersecurity, privacy, AI, and technology regulations.
• Help stakeholders distinguish regulatory requirements, certification requirements, contractual obligations, customer preferences, and internal security standards.
• Coordinate evidence for customer-driven audits and assessments with evidence collected for Compliance or other customer audits, and assist in tracking and resolving customer audit findings where Cloud SG has a remediation obligation.
• Support review of new and renewal customer contracts, security addenda, data protection agreements, questionnaires, and related security documentation.
• Identify and coordinate assessment of contractual requirements related to security, privacy, compliance, audits, incident notification, vulnerability management, penetration testing, data protection, and business continuity.
• Identify contractual provisions that could create commitments beyond Cloud SG’s policies, controls, certifications, or operational capabilities.
• Provide Legal with standardized, approved Security language and supporting technical information, and help negotiate security requirements through fact-based technical and risk analysis.
• Identify recurring customer requirements, emerging regulatory expectations, security trends, and documentation gaps, and convert them into scalable Trust Center content, standard responses, knowledge articles, process improvements, and automation opportunities.

Benefits

• Healthcare benefits for U.S.-based employees.
• Life insurance benefits for U.S.-based employees.
• Disability benefits for U.S.-based employees.
• 401(k) plan and company match for U.S.-based employees.
• Some roles may be eligible for an annual bonus and sales incentives, subject to the applicable plan, role, and individual performance.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level