Internal Auditor

Department: Risk and Compliance

Location: Pune

Description

• We are seeking an experienced Internal Auditor to support the business in achieving its objectives by conducting audits of our Global Information Security Management System (ISMS).
• Reporting to the Group Security Audit & Assurance Manager, this role is responsible for performing technology, information security, cybersecurity, and compliance audits to assess the effectiveness of our ISO 27001 controls.
• To be successful in this role, candidates must demonstrate excellent communication skills, hold ISO 27001 Lead Auditor certification, and possess strong documentation capabilities.
• The ability to clearly articulate technical concepts to both technical and non-technical stakeholders across the organisation is essential.
• Familiarity with additional industry standardssuch as Cyber Essentials, Cyber Essentials Plus, PCI-DSS, NYDFS 23 NYCRR 500, ISO 42001, CSA, and SOC 2is highly advantageous.
• We are looking for individuals with strong interpersonal skills who can build effective working relationships at all levels.
• The ideal candidate is a collaborative team playerflexible, approachable, and capable of managing multiple workstreams while meeting deadlines and maintaining excellent stakeholder engagement.
• This is a full-time, office-based position located in Pune. Hybrid working arrangements may be considered following successful completion of the probation period.
  
  

Key Responsibilities

• Conduct technology, information security, cybersecurity, and compliance audits to assess the design, efficiency, and effectiveness of internal security controls.
• Lead remediation discussions with stakeholders, ensuring clear guidance and timely resolution of audit findings.
• Develop audit plans, including scope and objectives, and ensure audit assignments are completed accurately and within agreed timelines.
• Engage and collaborate with key internal stakeholders, maintaining professionalism to ensure successful delivery of audit engagements.
• Perform remote auditing activities, including assessments of physical security controls.
• Serve as an escalation point for internal audit queries, providing clarity and expert guidance.
• Produce highquality audit documentation, reports, and supporting evidence.
• Prepare and deliver monthly KPI/KRI reporting.
• Support the coordination and delivery of global ISO 27001 external audits.
• Share best practices and contribute to the promotion of innovation across the security function.
• Foster a culture of continual improvement across all aspects of security.
• Demonstrate the company's core values: We are Dynamic, We are Innovative, We are Connected, and We Succeed Together.
• Perform additional duties as required to support the wider Information Assurance team.
  
  

Skills, Knowledge & Expertise


Experience

• Minimum of five years handson experience in an information security audit, risk management, or related assurance role.
• Proven experience auditing against established information security and cyber risk frameworks, including ISO 27001, NIST CSF, CIS Controls.
• Practical experience reviewing and assessing information security risk management processes, including risk assessments, control effectiveness, and related reporting.
• Demonstrated capability in drafting and maintaining audit documentation such as audit schedules, planning materials, policies, procedures, and reports that align with recognised security frameworks and regulatory requirements.
• Skilled in preparing and delivering clear, concise, and stakeholderspecific audit reports.
• Experience in a thirdline governance, compliance, or risk assurance function within a large or complex organisation is desirable.
• Experience working within regulated industries is advantageous.
  

Education

• Bachelor's degree or higher in Information Security, Computer Science, or a related discipline.
  

Knowledge

• Strong understanding and practical experience with ISO/IEC 27001:2022, including both audit and implementation activities (implementation is advantageous).
• Solid knowledge of ISO 31000: Risk Management Guidelines.
• Working knowledge of key cybersecurity frameworks such as the NIST Cybersecurity Framework (CSF) and CIS Controls.
• Familiarity with security governance and compliance practices, including the development and interpretation of policies, standards, and procedures.
• Good understanding of IT infrastructure, cloud services, business applications, and thirdparty supplier risk management.
• Proficient in risk assessment methodologies, including risk identification, analysis, evaluation, and mitigation strategies.
• Strong understanding of security incident response processes, including escalation, investigation, and reporting.
• Awareness of relevant regulatory and legal requirements, including:

• GDPR
• UK Data Protection Act
• EU AI Act
• India Digital Personal Data Protection Act (DPDPA)
  

Skills

• Exceptional attention to detail, with strong analytical, reporting, and communication capabilities.
• Clear and confident communicator, able to translate complex security concepts into language suitable for both technical and nontechnical audiences.
• Strong stakeholder management skills with a focus on delivering an excellent customer experience.
• Proactive, selfmotivated problem solver with the ability to work independently and take initiative.
• Flexible, approachable, and effective in collaborative, fastpaced environments.
• Resultsdriven and commercially aware, with the ability to align security activities to business objectives.
  

Ability

• Ability to perform information security internal audits and produce clear, accurate, and wellstructured audit findings.
• Collaborative team player, comfortable working alongside crossfunctional teams including departments such as IT, Legal, HR, Risk, and Operations.
• Capable of leading smallscale initiatives and contributing to continual improvement across security and risk audit activities.
• Quick learner with a strong growth mindset, adaptable, and able to adjust effectively to changing priorities.
• Strong understanding and practical experience with key information security and cyber risk frameworks, including ISO 27001, ISO 31000, NIST RMF/CSF, and CIS Controls.
• Proven experience in conducting audits focused on information security and risk management.
• Excellent English communication skills, both written and verbal, with the ability to convey complex information clearly and effectively.
• Relevant professional certification, including:
• ISO/IEC 27001:2022 Lead Auditor
• A confident, collaborative team player who enjoys audit work and thrives in an environment that focuses on solutions rather than problems.
  

Desirable:
CISA Certified Information Security Auditor
ISO/IEC 27001:2022 Lead Implementer
CISM Certified Information Security
CRISC Certified in Risk and Information Systems Control