Information Security Engineer

Job Title: Information Security
Location: Gurgaon
Employment Type: Full-Time


Job Summary
We are seeking a highly skilled and detail-oriented Information Security (DGM) to oversee and maintain the security and compliance framework for our organization, which specializes in technology product and HR & Finance process related security aspects. This role involves managing compliance with SOC 1 Type 2, SOC 2 Type 2, ISO ISMS & PIMS, ITGC, CASM, VTRM, and VAPT standards for both processes and technology products.

The ideal candidate will lead a small team and work with external auditors to ensure successful periodic audits, third-party certifications, conduct internal audits, and the implementation of effective controls and measures to maintain compliance and mitigate risks. A critical aspect of this role involves working closely with process owners to implement the controls/measures, extract necessary evidence, ensuring seamless communication, collaboration, and timely compliance reporting.

Key Responsibilities

Compliance & Certification Management:

1. Oversee and manage compliance with SOC 1 Type 2, SOC 2 Type 2, ISO 27001 (ISMS), ISO 27701 (PIMS), ITGC
2. Act as the primary point of contact for third-party audits and certifications.
3. Collaborate with external auditors and stakeholders to ensure timely completion of certifications and periodic audits.
4. Preference will be given to candidate with additional exposure to CASM, VTRM, and VAPT requirements.

Internal Audits & Risk Management:

1. Plan, execute, and oversee internal audits for processes and technology products to ensure compliance with regulatory and certification standards.
2. Identify gaps, implement corrective actions, and design controls to strengthen the organization’s security posture.
3. Continuously monitor and improve IT governance, risk management, and security practices.
4. Conduct regular awareness sessions on the floors across multiple locations within India & outside.

Communication & Cross-Functional Collaboration:

1. Build strong working relationships with process owners across various departments to extract evidence and ensure adherence to implemented controls.
2. Simplify complex compliance and audit requirements into actionable steps for stakeholders.
3. Drive accountability by providing clear communication on deliverables, timelines, and expectations for process owners.
4. Address communication gaps and ensure alignment between the security team and other business units to minimize dependencies.

Team Leadership & Coordination:

1. Manage team, delegating responsibilities to ensure seamless execution of internal audits, controls, and measures while contributing in individual capacity wherever required.
2. Provide mentorship, training, and guidance to team members to enhance their knowledge of security and compliance standards.

VAPT (Vulnerability Assessment & Penetration Testing):

1. Oversee the periodic vulnerability assessments and penetration testing (VAPT) of applications and infrastructure.
2. Collaborate with IT Infrastructure team and product teams to address vulnerabilities and implement security best practices.

Documentation & Reporting:

1. Maintain accurate and up-to-date documentation of security policies, procedures, and audit findings in line with controls.
2. Prepare reports on audit outcomes, compliance status, and risk assessments for senior management and stakeholders.

Policy Implementation:

1. Develop, implement, and enforce information security policies and standards across the organization.
2. Ensure alignment with enterprise security practices and data privacy regulations.

Key Qualifications
Education: Bachelor’s degree in Information Security, Computer Science, or a related field.
Experience:
13+ years of experience in information security, compliance, and risk management.
Proven track record of managing SOC, ISO, and IT security frameworks.
Hands-on experience with third-party audits and certifications.
Certifications: Preferable certifications include CISSP, CISA, CISM, ISO 27001 Lead Auditor, or similar.

Skills:

1. Strong knowledge of SOC 1, SOC 2, ISO ISMS & PIMS, ITGC.
2. Added advantages will be given to candidates with understanding of CASM, VTRM, and VAPT standards.
3. Excellent leadership and team management skills.
4. Exceptional communication and collaboration skills to work effectively with cross-functional teams and process owners.
5. Strong analytical and problem-solving skills.
6. Proficiency in documentation and reporting.