Information Security Engineer

Responsibilities

• Develop and finalize policies, procedures, and guidelines related to IT and Infosec domains (ISO 27001, GDPR, SOC 2)
• Align internal IT and Infosec processes with industry standards
• Maintain the security risk register and IT vendor inventory
• Perform 3rd party security due-diligence and periodic vendor risk assessments
• Coordinate periodic penetration testing exercises and ensure timely closure of risks
• Assist in security awareness training and phishing simulation exercises
• Lead periodic IT and Infosec governance review meetings
• Coordinate and facilitate SOC 2 audits as the primary point of contact
• Gather evidence and documentation to demonstrate compliance with SOC 2 requirements

Requirements

• 5-7 years of experience in information security
• Minimum 4 years in IT and Infosec governance activities
• Mandatory knowledge and experience in SOC 2 requirements
• Experience developing and implementing enterprise GRC strategy and solutions
• Familiarity with industry standards such as PCI, ISO 27001, GDPR, CIS, and NIST
• Understanding of public cloud security (AWS, Google, Microsoft Azure)
• Excellent verbal and written communication skills

Preferred Qualifications

• Industry recognized certifications such as CISSP, CISM, ISO 27001, or CISA
• Experience in the BFSI sector