Responsible for reviewing, maintaining, and updating security policies, procedures, and standards / baselines.Support all accreditation programs such as ISO27001, ISAE 3402 Type II, SOC2 Type 2, PCI-DSS and others as may be needed.Work with different stakeholders including external auditors, business leaders, DPO, Legal, HR, and CIO teams to understand all critical security requirements.Drive security compliance monitoring.Risk assessment for information security and cyber risksAdoption of global frameworks such as NIST Cyber Security and CIS etc.Work with internal Marketing team and external vendors for developing security awareness program.Support Business Continuity program including BC Plans, Crisis Management etc.Perform internal security audits. Manage certifications such as ISO 27001, SOC etc.Perform security audits on application and IT infrastructure including but not limited to network, operating systems (Windows and Linux), databases, access control, Firewalls, IDS / IPS, Web Application Firewalls, Proxies, Cloud infrastructure (Azure and Amazon), Web servers, data center, Email infrastructure, VPN infrastructure, routers, backups, Disaster Recovery, Endpoint Security.Perform security audits to ensure that controls related to these processes are adequate to mitigate risks.Perimeter / Internal Security Technologies (Firewalls, IDS / IPS, Proxy, WAF etc.)Data Loss Prevention technologies and support processesNetwork Segmentation and Separation SolutionsIdentity and Access Management, Privileged Access and Authentication SolutionsPlatform and Configuration HardeningIT incident and problem managementThreat Intelligence and Insider Threat DetectionVulnerability assessment, Penetration Testing, and its mitigationSecurity Incident and Event Management (SIEM) TechnologiesCyber Incident and responseChange ManagementRole Based Access ControlsBusiness continuity and Disaster RecoveryVendor security assessmentsMinimum Qualification & Background :
- 5-10 years of relevant experience
- Graduate with one or more professional certifications : ISO27001 LA, CISA, CRISC, CISSP and CISM
- Must have experienced a complete ISO27001 journey for a few years at a minimum.
- Knowledge and understanding of ISO27001, ISO27002, ISO27017, ISO27018, PCI DSS, NIST cyber security standards and CIS benchmarks.
- Must have performed audits of the cloud infrastructure.
- Knowledge and understanding of security related technologies and cloud security.
- Excellent written and verbal communication skills; Documentation and presentation skills
Skills Required
Security Policies, Risk Assessment