Governance, Risk, and Compliance (GRC) - Information Security Engineer

Roles and Responsibilities:

Perform gap analysis of information security standards such as ISO27001:2022 and create compliance reports for information security standards such as IS and other requirements

Preparation and the implementation of necessary: Information security policies, standards, procedures and guidelines, in discussion with the departments, CISO/ Information Security Committee, to get appropriate approvals and feedback, for implementation.

Manages the design and operation of related compliance monitoring and improvement activities to ensure compliance both with internal security policies etc. and applicable laws and regulations

Support department and help manage implementation of information security management system. Conduct Information security awareness training and educational activities to stakeholders.

Manages information security risk assessments and controls selection activities

Liaison with stakeholders and offers strategic direction to related governance functions (such as Risk Management, IT, HR, Legal and Compliance)

Liaison with senior and middle managers throughout the project organization as necessary, on information security matters such as routine security activities plus emerging security risks and control technologies

Manage Third Party Security Assessment Program to minimize risk associated with business partners and vendors.

Perform testing of internal controls specified in Information Security Policies and Perform internal audit reviews to assess the effectiveness of current information security controls

Ensure timely and effective corrective actions are taken to correct deficiencies and provide status reporting.

Support the Information Security program including development, collection, assessment, and reporting of metrics

Recommend security policy changes and enhancements as needed

HIPAA, Digital Payment Security Controls (Internet Banking Security Controls, Mobile Banking Security Controls, PCIDSS, ITGC, SOC2

Good to have:

Should have Bachelors/Master's degree

Professional certification viz., ISO 27000 Implementer/Lead Auditor, CEH, CCNA etc.

Should have led at least Two implementation of ISMS and one implementation as Lead Auditor.

Broad-based IT experience with technical knowledge of Networks, Hardware, Storage, Operating systems, and Applications, Business Impact Analysis, RTO/RPO.

Up-to-date understanding of emerging trends in information security and apply new techniques and trends, in-line with overall information security objectives and risk tolerance

Good writing skills for Policy & Procedures documentation

Information Security Awareness, Training and Assessment: Preparing Training plans and conducting relevant Trainings for stakeholders

Experience in working on Cyber Security Projects of Government/ Industry

Basic understanding of SDLC, SOC, Networking