Senior Information Security Analyst

Company Description

Rubrik is one of the fastest growing companies in Silicon Valley, revolutionizing data protection and management in the emerging multi-cloud world. We are the leader in cloud data management, delivering a single platform to manage and protect data in the cloud, at the edge, and on-premises. Enterprises choose Rubrik to simplify backup and recovery, accelerate cloud adoption, enable automation at scale, and secure against cyberthreats. Rubrik has raised over $553 million in venture funding, most recently at a valuation of $3.3 billion. We’ve been recognized as a Forbes Cloud 100 Company five years in a row and as a LinkedIn Top 10 startup. 

Information Security - Who We Are

The Information Security organization advances the overall state of security at Rubrik through critical initiatives and coordination of large security projects. Information Security builds technologies, tools, and processes to better enable teams at Rubrik to develop secure software and protect data and systems with appropriate security controls. Information Security also develops systems to monitor and respond to attacks against our systems, provides awareness education to teams on security best practices for data protection, and ensures data sharing relationships with third parties in order to securely protect Rubrik information.

What You’ll Do:

Rubrik is seeking a Senior Information Security Analyst to help drive and support our team globally on our Security Compliance product certifications, audits and improve the maturity of our systems, tools and processes. In this role, you will prepare Rubrik to expand our product certifications and compliance offerings as well as help drive our existing ones. As a member of the Security Compliance team, you are a highly motivated individual who will be responsible for the execution and continuous maturity of these services. The successful candidate will need to build and maintain strong cross-functional relationships across the company. To achieve this you must have excellent leadership, communication, and decision making skills.

Mandatory Skill Sets-  “security compliance” “PCI”, “HIPAA”, “ISAE”, “SOC 2”, “NIST 800-53", “ISO”, “coordinated audits”, “integrated audits”, “unified control framework

Responsibilities:

• Be an integral member of the security and compliance team to build and maintain strong cross-functional relationships across the company, aid in achieving consensus, expectation setting, security compliance, training and awareness, and promote consistency and improvement in our processes.
• Drive security compliance product certifications including managing external and internal audits, performing readiness assessments for standards and frameworks, and making recommendations on policies, processes, awareness training, roadmap and priorities.
• Manage and drive coordinated / integrated audits (e.g. SOC 2 / ISAE 3000, PCI, HIPAA, etc.)
• Help manage and maintain Rubrik’s Unified Control Framework, implement and manage assessments and audits within our Infosec GRC tool
• Support the development, revision and finalization of security and compliance control language in internal and external audit documentation.
• Be well-versed in vulnerability management and penetration testing practices as they pertain to the requirements and control frameworks and standards above.
• Be well-versed in Rubrik's products as they pertain to security and compliance features and secure SDLC practices.
• Drive continuous improvements to the external facing compliance web page that disseminates security and compliance related efforts.
• Contribute to the maturity and measurement of the security compliance program by developing and revising operational metrics, and creating dashboards in GRC tools, Tableau and JIRA/Confluence.
• Contribute to security program development by identifying new or emerging opportunities to apply security principles and technologies.

Preferred Qualifications:

• 6+ years of related work experience in information security governance, risk and compliance (GRC) or relevant compliance roles in the tech industry.
• Experience driving security compliance certifications and audit programs within a B2B SaaS provider.
• Experience managing integrated audits (e.g. SOC 2 / ISAE 3000, PCI, HIPAA, etc.,)
• Strong understanding of relevant information security and compliance frameworks including ISAE 3000 / 3402, PCI DSS, HIPAA, SOC 2 Trust Services Criteria, ISO 27001/2 (including ISO 27017 & 18), CIS Top 20, COSO, NIST CSF / 800-53, and FedRAMP.
• Knowledge of audit methodologies, such as SOX and COBIT.
• Experience with implementing and managing GRC tools for managing a company’s Unified Control Framework and conducting internal and external audits.
• Experience with the use of, management of Confluence wiki pages, JIRA Boards for tracking security compliance gaps through to remediation and Tableau for metrics reporting.
• Can implement a solution (design), operational plan, and roadmap to achieve goals.
• Knows how to estimate work effort and incubate skill sets to achieve team goals.
• Has knowledge of common security risks, vulnerabilities, and threats, SSDLC, and can make recommendations and review processes pertaining to these areas based on security compliance requirements.
• Detail-oriented, organized and able to understand the bigger picture by using technical expertise and problem solving abilities to prioritize and manage issues.
• Ability to ramp up quickly and learn new technologies and products with minimal lag time.
• Strong communications skills and the ability to discuss issues at technical and business levels with audiences of various backgrounds.
• Bachelor’s degree in Security, Computer Science, Management Information Systems, Engineering or related field, and in a high growth business environment preferred.
• SaaS and data management industry experience.
• Professional certifications in Information Security or Risk Management (e.g. CISSP, CISA, CISM, CCSK, CRISC, CGEIT, CSX-P, PCI-QSA) is a plus.
• Project Management experience and PMP certification is a plus

Rubrik provides equal employment opportunities (EEO) to all employees and applicants for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age or disability. In addition to federal law requirements, Rubrik complies with applicable state and local laws governing nondiscrimination in employment in every location in which the company has facilities. This policy applies to all terms and conditions of employment, including recruiting, hiring, placement, promotion, termination, layoff, recall, transfer, leaves of absence, compensation and training.

About Rubrik:

Rubrik, the Zero Trust Data Security Company™, delivers data security and operational resilience for enterprises. Rubrik’s big idea is to provide data security and data protection on a single platform, including Zero Trust Data Protection, Ransomware Investigation, Incident Containment, Sensitive Data Discovery, and Orchestrated Application Recovery. This means your data is ready so you can recover the data you need, and avoid paying a ransom. Because when you secure your data, you secure your applications, and you secure your business.

We are a leader in data security, have been recognized as as a Forbes Cloud 100 Company and named as a LinkedIn Top 10 Startup. There has never been a more exciting time to join Rubrik, and our future is even brighter. The work you do will help propel our next chapter of growth as you do the best work of your career.

Linkedin | Twitter | Instagram | Rubrik.com | 

Diversity, Equity & Inclusion @ Rubrik: 

At Rubrik we are committed to building and sustaining a culture where people of all backgrounds are valued, know they belong, and believe they can succeed here.

Rubrik's goal is to hire and promote the best person for the job, no matter their background. In doing so, Rubrik is committed to correcting systemic processes and cultural norms that have prevented equal representation. This means we review our current efforts with the intent to offer fair hiring, promotion, and compensation opportunities to people from historically underrepresented communities, and strive to create a company culture where all employees feel they can bring their authentic selves to work and be successful.

Our DEI strategy focuses on three core areas of our business and culture:

• Our Company: Build a diverse company that provides equitable access to growth and success for all employees globally. 
• Our Culture: Create an inclusive environment where authenticity thrives and people of all backgrounds feel like they belong.
• Our Communities: Expand our commitment to diversity, equity, & inclusion within and beyond our company walls to invest in future generations of underrepresented talent and bring innovation to our clients.

Equal Opportunity Employer/Veterans/Disabled: Rubrik is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, or protected veteran status and will not be discriminated against on the basis of disability.

Rubrik provides equal employment opportunities (EEO) to all employees and applicants for employment without regard to race, color, religion, sex, national origin, age, disability or genetics. In addition to federal law requirements, Rubrik complies with applicable state and local laws governing nondiscrimination in employment in every location in which the company has facilities. This policy applies to all terms and conditions of employment, including recruiting, hiring, placement, promotion, termination, layoff, recall, transfer, leaves of absence, compensation and training. 

Federal law requires employers to provide reasonable accommodation to qualified individuals with disabilities. Please contact us at hr@rubrik.com if you require a reasonable accommodation to apply for a job or to perform your job. Examples of reasonable accommodation include making a change to the application process or work procedures, providing documents in an alternate format, using a sign language interpreter, or using specialized equipment.