Information Security Lead Auditor

Responsibilities:

• Over 8 yrs of experience across various domains and industries and handling teams of various expertise.
• Plan, develop and implement org-level audit strategies with the objective of minimizing the Information security risks, achieving scalability, sustainability and improvements in information security requirements and GDPR requirements. Understanding client specific information security policies and process, plan and conduct entity level audits, vulnerabilities assessments, system audits and technical audits for mitigating risks to the organization and to the clients within norms and policies of Infosys.
• Security risk analysis; Planning & execution of audits; review reports; cross functional liaison; customer interfacing; help in standardization of processes thro Corrective and preventive actions of Information security risks identified.
• Create audit strategy for an account / unit level and implement org-level audit strategies, develop audit plans for conducting audits for minimizing organizational risks in order to achieve scalability, sustainability and improvements in Information security and customer satisfaction
• Perform Entity level information security , BCMS and GDPR process audits covering both security policies and contractual commitments, report noncompliance to relevant stakeholders, ensures submission corrective and preventive actions for security audit NCRs. Assess the effectiveness of closure in order to ensure Account level/unit level Information security process and client specific security requirements are compliant
• Conduct technological audits including audits on network architecture, deployed solutions (viz, DLP solutions), storage, SAM, Security risk analysis, vulnerability assessments, Penetration test and forensic analysis. Analyze audit reports and work towards improving efficiencies in audits.
• Conduct audits in the areas of information security, regulatory requirements v.i.z, GDPR , PCI-DSS, HIPAA, SOX, SSAE 18, SOC 1, SOC 2, ISAE 3402
• Conduct in-depth audits on business continuity focus area at various levels, account level, support functional level, locational level and identify systemic issues across the areas.
• Conduct senior management audits on information security, business continuity and contractual requirements.
• Should possess statistical analysis skills to perform trend analysis of internal audit findings at various levels (eg: account level, locational level, unit level) and highlight recurring risks to governance forums.
• Provide support at entity level for recording and analyzing Information security incidents
• Conduct forensic analysis: Information security understands the Trace evidence and conduct technical investigation in order to find out if there is any security compromise
• Study contractual commitments and customer requirements, study organizational and account information security process requirements. audit current performance levels, in order to draw inferences about account level information security process performance and ensure client security process, policies and contractual commitments are achieved
• Process changes identified through audits across organization /accounts need to be analyzed and provide inputs to process groups for effective change management in order to institutionalize the changes across organization.
• Identify information security risks, contractual risks based on audit findings across organization and bring it to the notice of senior management in order to safeguard organizational assets/ client assets
• Provide Technical Inputs to standards team in order to handle exceptions in secure configuration standards. Establish communication with engineering group of product companies in order to resolve implementation issues and receive product updates
• Manage and forecast resource requirements, training and development requirements of the team in order to ensure operational efficiency, adequacy in skills, training and motivation.
• Provide inputs to delivery units on recurring issues and assist in bringing process improvements and minimize customer complaints.
• Consolidate and provide inputs regarding activities that have budget/resource (hardware, software, training etc) implications. in order to help budget decisions.
• Involve in standardization of processes thro Corrective and preventive actions of Information security risks identified
• Should be able to respond to RFPs, MSA/contract, security questionnaires.
• Should be able to self drive team level initiatives like Automation or AI specific initiatives and help in achieving the objectives for process improvement and efficiency in conducting audits.
• Should be able to quickly learn any programming languages, Excel Macros, Power BI, etc. to create meaningful dashboards for the consumption of the leaders of various levels.

Skillset:

• Requires extensive expertise on Microsoft Excel and PPT
• Independently work with minimal support/follow-ups
• Should be extremely meticulous, since work will be mostly with data & numbers
• Analytical ability, Good Communication, quick learner, Interpersonal Skills, Presentation skills
• Customer interfacing and negotiation skills.
• Able to work with cross-cultural teams, management team/senior team members, time management and sticks to deadlines.