Assistant Manager Infosec Audit

Profile

- Conduct IT security and IT Site audits in compliance with standards such as NIST, ISO 27001, PCI- DSS and Organisation`s Policies and Procedures.

- Publish Audit reports and suggest remediation/mitigation measures for all business units across India.

• Understanding of ISO 27001 standards.
• Knowledge of Information Security standards and policies (Internal and General)
• 5 + years in information security or cybersecurity

Preferred candidate profile

1. Conduct IT Audits: Perform audits to ensure compliance with standards like NIST, ISO 27001, PCI- DSS and Organisation`s Policies and Procedures, also publish reports and suggest remediation/mitigation for all business units across India.

2. Risk Assessment: Identify, evaluate, and report on technology and information security risks.

3. Project Support: Facilitate risk assessments for new projects, changes to existing solutions, and contractual obligations.

4. Third-Party Analysis: Assess risks associated with third-party tools and services

5. Network and Server Audits: Conduct thorough audits of network infrastructure and server environments to ensure security and compliance.

6. Process Improvement: Continuously update and improve standard operating procedures (SOPs) and checklists for auditing systems.

7. Performance Monitoring: Track and review the effectiveness and efficiency of audit activities by conducting post-audit reviews.

8. Issue Resolution: Follow up on open observations, facilitate calls, and suggest remediation to ensure timely closure.

9. Daily Follow-Up: Facilitate daily calls to track the status of ongoing audit activities and closures of pending actions.

10. Reporting: Prepare weekly dashboards, reports, and presentations for audit activities. Prepare internal reports such as auditor summaries for pending action tracking.

Technical Skills:

• Operating Systems: Proficiency in Windows, Linux, and Unix systems, including network security and configuration.
• Virtualization: Knowledge of VMware, Hyper-V, and other virtualization technologies.
• Cloud Computing: Understanding of AWS, Azure, and Google Cloud, including their security features.
• Endpoint Security: Familiarity with antivirus, anti-malware, and endpoint detection and response (EDR) solutions.
• User Access Controls: Knowledge of identity and access management (IAM) systems, including multi-factor authentication (MFA) and single sign-on (SSO).
• Software Management: Understanding of software deployment, patch management, and application whitelisting.
• Server Management: Skills in server hardening, database management (SQL and NoSQL), and backup and recovery solutions.
• Network Security: Expertise in firewalls, intrusion detection/prevention systems (IDS/IPS), and virtual private networks (VPNs).
• Network Architecture: Understanding of network design principles, including segmentation and secure protocols.
• Wireless Security: Skills in securing wireless networks, including WPA3 and enterprise-level security measures.

General IT Auditing Skills:

• Information Security: Knowledge of cybersecurity principles, risk assessments, vulnerability management, and compliance with standards like NIST and Sarbanes-Oxley.
• Compliance and Standards: Familiarity with ISO 27001, NIST, GDPR, and HIPAA.
• Risk Assessment: Ability to conduct risk and vulnerability assessments.
• Database Management: Proficiency in database systems (e.g., SQL) and data analysis for evaluating data integrity and security.
• Software Applications: Understanding of software applications and their security features.
• Internal Controls and Auditing Standards: Knowledge of internal controls, auditing standards (e.g., COBIT), and regulatory requirements.

Soft Skills:

• Communication: Effective communication skills for reporting findings and recommendations.
• Project Management: Ability to manage audit projects, including planning, execution, and follow-up.
• Attention to Detail: Keen attention to detail to identify security gaps and compliance issues.
• Analytical Skills: Strong analytical skills for identifying and addressing IT system issues.
• Documentation: Effective documentation skills to create clear and concise audit observations.
• Data Analysis: Proficiency with data analysis tools and techniques for evaluating system logs and audit trails.