Lead - Information Security & Compliance Engineer

Role & responsibilities

• Implement cybersecurity best practices across networks, applications, and cloud environments.
• Lead and maintain ISO/IEC 27001 standards, ensuring compliance with NIST, CIS Controls, and industry regulations.
• Conducting risk assessments, gap analyses, and defining security controls, policies, and procedures.
• Plan and conduct internal ISO 27001 audits, identify non-conformities, and recommend corrective actions.
• Assist in external audits and manage risk mitigation efforts to enhance security posture.
• Updated knowledge on cybersecurity threats and frameworks (NIST, CIS, GDPR).
• Perform vulnerability assessments, conduct penetration tests, and establish log analysis and threat detection capability.
• Maintain technical documentation (policies, risk registers, and audit reports) and develop security training materials.
• Integrate security into the development lifecycle.
• Conduct code reviews, threat modeling, and secure software assessments.
• Work closely with Western clients, ensuring clear communication on security requirements.
• Provide security advisory and consultation to clients and stakeholders.
• Translate complex cybersecurity concepts into business-friendly language
• Conduct employee training sessions on information security policies, procedures, and best practices.
• Promote a culture of security awareness and ensure employees understand their roles in maintaining compliance.
• Foster a collaborative and security-conscious culture within the team.
• Recruit, train, and retain top cybersecurity talent.
• Drive initiatives for continuous improvement and innovation in security practices.
• Manage the internal and external client relationships

Preferred candidate profile

• Threat detection, Incident response, and Risk management
• Knowledge of SIEM tools like Wazuh/ Splunk/ SentinalOne/ AlienVault OSSIM (Now known as AT&T Cyber Security)
• Implementation of ISO 27001
• Knowledge of NIST, CIS, GDPR, SOC 2, PCI-DSS frameworks.
• AWS, Azure, GCP, IDS/IPS, vulnerability scanners, GRC tools
• Problem-solving, Analytical, and decision-making.
• Documentation capabilities
• Team management, client handling, and cross-functional collaboration.

Perks and benefits