Information Security Manager- ISO 27001 LA

Job Title: Manager Information Security – ITJob Purpose: Acting in a key technical management & execution capacity toprovide a conduit between IT teams and key business stakeholders in yourfunctional area of IT Security to ensure information technology needs aremanaged consistently, following professional IT and global standards, anddelivered with a high level of quality and customer satisfaction.Reward level: Middle ManagementJob Location GurgaonExperience 10+ yearsRelevant Experience 7+ yearsReporting to: General ManagerQualification: Bachelor’s degree in ITKey Deliverables: Provide support as Lead auditor towards ISMS and PIMS policies,procedures, and guidelines and perform regular review and update. Perform deep assessment to gather evidence of continuous compliance withISO 27001:2022 and ISO 27701:2019, DPDPA, IT Act and Cert In Regulationincluding audit logs, records of reviews, timely closure of open audit and risksand sharing the report with management. Conduct regular, documented information security and privacy riskassessments identifying assets, threats, vulnerabilities, likelihood, and impactwith stakeholders. Prioritize identified vulnerabilities, detailed findings, remediationrecommendations, trending reports on vulnerability posture towards closurewith stakeholders. Development and implementation of a comprehensive, ongoing securityawareness and training program for all employees. Encourage secure behaviours among colleagues and reinforce theimportance of information security and privacy in daily operations. Prepare regular report on overall information security posture, GRC maturity,and risk landscape to relevant stakeholders Ability to collect lessons learned from incidents, audits, and assessments todrive continuous improvement in ISMS/PIMS and security processes.Key Relationships: Internal IT and business customers in MSR. Global IT Vendor, market and global (HQ) colleagues, Local vendor partners Internal staff - direct reports (where applicable) IT vendors, contractors (where applicable)Knowledge Skills and Abilities: Must possess and demonstrate ISO 27001 Lead Implementer/Auditor and ISO27701 Lead Implementer/Auditor certifications and knowledge. In depth understanding of IT Act, DPDPA, Cert In regulations, CIS Controls aswell as UK DPA and ISO 31000 Good to have certification on CISM (Certified Information Security Manager),CISSP (Certified Information Systems Security Professional) and Cloud Securitycertifications (e.g., CCSK, CCSP, vendor-specific like AWS Security Specialty) Familiarity with common vulnerability scanning tools like Qualys (features,reporting, agent-based vs. network scans) and Cloud Security PostureManagement (CSPM) tools like Wiz (cloud service provider configurations,misconfigurations, compliance checks in AWS, Azure, GCP). Understanding of various penetration testing types (e.g., network, webapplication, API, mobile, cloud) and methodologies Knowledge of common attack vectors and exploitation techniques like MITREATTACK and DEFEND framework. Basic to intermediate knowledge of common security controls and technologies(e.g., firewalls, EDR, Cloud Security, VAPT tools, SIEM, WAF, DLP, encryption). Understanding of network protocols, operating systems (Windows, Linux), andcommon application architectures. Knowledge of audit principles and practices (internal and external audits). Understanding of corrective action planning and non-conformity management. Understanding of third-party risk management principles and vendor duediligence processes. Excellent technical writing skills for creating clear, concise, and comprehensivesecurity policies, standards, and procedures. Ability to analyse complex risk data and present actionable insights. Hands-on experience with Qualys for configuring scans, analysing reports, andmanaging vulnerabilities. Hands-on experience with Wiz CSPM for monitoring cloud environments,identifying misconfigurations, and generating compliance reports. Proficiency with GRC platforms or tools for managing policies, risks, and controls Exceptional verbal and written communication skills to articulate complex securityconcepts to technical and non-technical stakeholders Ability to build strong relationships and collaborate effectively with diverse teams(IT, Legal, HR, Development, Business Units). Skills in influencing behaviour and driving change across the organization toimprove security posture. Strong analytical skills to diagnose security issues, identify root causes, anddevelop effective solutions. Ability to critically evaluate security controls and identify gaps. Contract review and negotiation skills specifically for security-related services. Ability to effectively manage vendor relationships and performance. Ability to develop and deliver engaging security training sessions and awarenesscampaigns. Ability to stay updated with the latest security threats, vulnerabilities,technologies, and regulatory changes. Capacity to quickly learn and adapt to new tools and methodologies. Meticulous attention to detail in policy creation, audit documentation, andvulnerability analysis. Ability to act calmly and effectively during security incidents and contribute toincident response efforts.mail updated resume with salary details-email: etalenthire[t]gmail[dot]comsatish- 88O [hidden]