Senior Associate (ID 1435)

Review, maintain, and document the organization's Information Security Management System (ISMS) policies, procedures, and records.

Coordinate and drive ISMS initiatives across the organization to ensure alignment with ISO/IEC 27001:2022 requirements.

Monitor organizational compliance with ISMS policies, procedures, and applicable security standards.

Prepare and present annual updates on ISMS initiatives, improvements, and compliance status to management.

Coordinate the implementation of employee information security awareness and training programs.

Plan and manage internal audits, external audit coordination, management reviews, and corrective and preventive actions within defined timelines.

Track and facilitate the closure of audit observations, compliance gaps, and non-conformities.

Follow up on reported security incidents, coordinate root-cause analysis with the ISO team, and share lessons learned across departments.

Coordinate with respective departments to ensure adherence to established ISMS policies and procedures.

Collaborate with cross-functional teams to implement security improvements and promote a security-first culture

Minimum 6+ years of experience in information security, information security management, compliance, or related initiatives.

Bachelor's or Master's degree in B.E., B.Tech, M.Tech, MS, or MBA, completed through a regular three- or four-year degree program.

Excellent verbal and written communication skills.

Expertise in at least five of the following areas:

• ISO/IEC 27001:2022 – Information Security Management System (ISMS)
  

• ISO/IEC 22301:2019 – Business Continuity Management System (BCMS)
  

• Risk assessment and gap assessment
  

• SOX, SOC 1, and SOC 2
  

• HIPAA and HITRUST
  

• Internal and external audits
  

• Policies and procedures review
  

• Control testing and incident response
  

• Stakeholder management
  

• Cybersecurity
  

Good understanding of privacy laws, governance, risk management, and compliance (GRC).

Ability to manage cross-functional teams, drive organization-wide security initiatives, and promote a security-first culture.

Strong understanding of IT infrastructure and security tools, including Windows Active Directory, Microsoft 365, SASE, WAF, firewalls, network and application security, DevSecOps, CI/CD pipeline security, SDLC, IAM, IGA, MFA, application security, RSA Archer, and cloud security across AWS, Azure, GCP, and OCI.