CSA Security Analyst

• Own assigned Customer Security Assurance requests from intake through completion, ensuring responses are accurate, timely, complete, and appropriately approved.
• Manage and respond to customer security questionnaires, due-diligence requests, RFP/RFI security requirements, customer assessments, and annual security reviews.
• Serve as the primary Security SME for assigned customer engagements and represent Cloud SG's security posture professionally and confidently.
• Participate in customer security calls, technical discussions, security briefings, due-diligence meetings, and customer audits.
• Explain Cloud SG's security architecture, controls, policies, certifications, risk management practices, and security operations to both technical and non-technical audiences.
• Analyze customer questions to determine the underlying security or compliance control requirement, not just the literal wording.
• Research complex or ambiguous customer security requirements and coordinate with appropriate internal SMEs to develop authoritative responses.
• Ensure responses are consistent with Cloud SG policies, technical implementations, certifications, regulatory obligations, contractual commitments, and approved security positions.
• Challenge responses that are incomplete, inconsistent, technically unsupported, or create unintended security or contractual commitments.
• Identify customer requirements that fall outside Cloud SG's standard security posture and appropriately escalate them for Security, Legal, Product, GRC, or Executive review.
• Maintain a sales-enablement approach while protecting Cloud SG from unnecessary security, regulatory, contractual, or operational commitments.

• Develop a strong working understanding of Cloud SG's cloud, SaaS, infrastructure, application, identity, endpoint, network, data protection, monitoring, vulnerability management, incident response, and secure development environments.
• Evaluate customer security questions against the underlying technical and operational controls implemented by Cloud SG.
• Understand the relationship between security requirements, control objectives, control implementation, evidence, and residual risk.
• Work with Security, Product, and Engineering SMEs to validate technical responses and ensure customer-facing information accurately reflects current implementations.
• Identify potential security gaps, control deficiencies, architectural concerns, or exceptions raised through customer due diligence.
• Assess customer-specific security requirements and determine whether they are: • Already addressed by existing controls;
• Addressable through standard Cloud SG processes;
• Requiring additional evidence or clarification;
• Requiring risk acceptance or exception management; or
• Requiring Legal, Product, Engineering, or Security remediation.

• Translate technical security issues into business and customer impact.
• Recognize when customer requirements create broader precedent or obligations across products, Business Units, or customers.
• Support risk-based decision-making rather than treating all customer requirements as equal or requiring identical responses.

• Apply practical knowledge of cybersecurity and compliance frameworks including ISO 27001, SOC 2, NIST, PCI DSS, FedRAMP, CMMC, ISO 42001, ISO 27701, HIPAA, and similar standards.
• Understand how customer requirements map to Cloud SG's existing compliance certifications, control environment, and security programs.
• Maintain awareness of current and emerging cybersecurity, privacy, AI, and technology regulations, including GDPR, DORA, EU Cyber Resilience Act (CRA), EU AI Act, and other applicable requirements.
• Support interpretation of regulatory requirements in the context of customer security expectations.
• Identify where customer requests extend beyond standard regulatory, contractual, or certification requirements.
• Provide guidance to stakeholders on the distinction between regulatory requirements, certification requirements, contractual obligations, customer preferences, and internal security standards.
• Support preparation for evidence based customer-driven audits and assessments. Coordinate requested evidence against those already collected for Compliance or other Customer audits, working with relevant SMEs for additional requirements.
• Assist in tracking and resolving customer audit findings where Cloud SG has an obligation to perform remediation.

• Support review of new and renewal customer contracts, security addenda, data protection agreements, questionnaires, and related security documentation.
• Identify security, privacy, compliance, audit, incident notification, vulnerability management, penetration testing, data protection, business continuity, and other technology-related contractual requirements.
• Coordinate with Cloud SG Legal, Privacy, Security, Product, Engineering, and other SMEs to assess proposed contractual requirements.
• Identify provisions that may create security commitments beyond Cloud SG's established policies, controls, certifications, or operational capabilities.
• Provide Legal with standardized, approved Security language and supporting technical information.
• Help negotiate security requirements by providing fact-based technical and risk analysis.

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Risk Management, Business or equivalent experience

•

in cybersecurity, GRC, security engineering, compliance, IT risk, audit or equivalent experience.

• Customer Security & Trust experience in a complex, multi-product, Cloud or Software as a Service corporation, or equivalent Third-Party/Vendor IT Risk Management experience
• Experience working with Sales and/or being customer-facing, representing company Security posture and controls across industry requirements.
• Knowledge of current, new, and upcoming regulations such as GDPR, DORA, CRA, EU AI Act, etc.
• Demonstrated experience working with

in a technology, SaaS, cloud, or enterprise environment.

• Strong understanding of cybersecurity principles, security controls, risk management, and compliance frameworks.
• Practical experience with one or more frameworks such as

.

• Ability to understand technical architecture, security controls, system configurations, and engineering processes sufficiently to evaluate compliance and risk.
• Strong analytical and problem-solving skills with the ability to investigate complex issues, determine root-cause, and define appropriate solutions.
• Excellent written and verbal communication skills.
• Demonstrated ability to build strong relationships and influence stakeholders across technical and business functions.
• Act as a

• Professional certification such as

.

• Experience with Loopio, Archer, ServiceNow or similar platforms.
• Experience supporting customer security questionnaires and security assurance activities.
• Familiarity with SIG Core and SIG Lite questionnaires and their requirements.
• Experience working with external regulators, certification bodies, customers, or regulatory assessors.

Compensation may vary depending on your location, qualifications including job-related education, training, experience, licensure, and certification, that could result at a level outside of these ranges. Certain roles are eligible for additional rewards, including annual bonus, and sales incentives depending on the terms of the applicable plan and role as well as individual performance.

CA generally ranges: $127,002-$190,502 All other locations fall under our General State range: $111,405-$167,107

Benefits may vary depending on the nature of your employment with Cloud Software Group and the country where you work. U.S. based employees are typically offered access to healthcare, life insurance and disability benefits, 401(k) plan and company match, among others. This requisition has no specific deadline for completion.