Information Security Analyst

What are we looking:

We are seeking a proactive and detail-oriented Information Security Analyst to support the organization's cybersecurity, governance, risk, and compliance initiatives. The ideal candidate will be responsible for monitoring and analyzing security alerts and incidents, coordinating vulnerability management activities, implementing and maintaining Information Security Management Systems (ISMS), and ensuring compliance with security standards and regulations such as ISO/IEC 27001, SOC 2, and the Digital Personal Data Protection (DPDP) Act.

Roles and Responsibilities:

• Monitor, analyze, and respond to security alerts and incidents generated by security monitoring tools (EDR, DLP, Microsoft Defender, etc.), and coordinate incident response activities.
• Lead and support the implementation and maintenance of the Information Security Management System (ISMS) in accordance with ISO/IEC 27001:2022, including policy development, risk assessments, and audit readiness.
• Support compliance initiatives related to SOC 2, DPDP Act, ISO 27001, and other applicable regulatory and customer security requirements.
• Perform vulnerability assessments using security tools (e.g., Qualys, Tenable, Nessus), coordinate remediation with technical teams, and track vulnerabilities until closure.
• Prepare and maintain security reports and dashboards, including vulnerability reports, incident reports, risk registers, compliance metrics, and management presentations.
• Conduct internal security audits and compliance reviews, identify gaps, track corrective actions, and ensure timely closure of audit findings.
• Develop and maintain security documentation, including policies, procedures, SOPs, standards, risk assessments, asset inventories, and audit evidence.
• Coordinate and support VAPT activities, review assessment reports, validate remediation, and maintain vulnerability exception records with appropriate approvals.
• Conduct security awareness and phishing simulation activities, promote cybersecurity best practices, and assist in improving the organization's security culture.
• Review and assess security controls related to access management, endpoint security, cloud security, data protection, backup, and business continuity to ensure compliance with organizational policies.
• Collaborate with Engineering, IT, DevOps, HR, Legal, and Business teams to implement security controls, manage risks, and support customer security assessments and external audits.