Lead InfoSec Engineer - GRC

Job Summary

Design, plan, and execute readiness activities relating to ISO 27001(ISMS), ISO 27701(PIMS), NIST CSF, DPDPA, etc., management systems. Develop and implement surveillance and recurring activities to maintain existing certifications and standards. Contribute and take ownership of the privacy management operations of the organization. Drive information security and privacy awareness activities through various channels such as mailers, digital posters, fliers, games, events, campaigns, and communications. Conduct targeted phishing simulations, assign remedial training, and ensure high completion rates. Develop role-based training requirements and ensure high completion rates. Deliver information security and privacy awareness sessions to new joiners during induction. Identify and manage risks through risk assessments, collaboration with risk owners, and continuous risk reporting to management. Evaluate and monitor the effectiveness of security controls through internal audits and security assessments, ensuring timely remediation of any identified gaps. Facilitate external audits in collaboration with internal stakeholders and auditors, ensuring timely closure of audit findings. Design, develop, and publish information security policies, procedures, and guidelines, managing their lifecycle activities. Track and ensure timely publication of Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs) by respective internal stakeholders. Identify and escalate risks in third-party engagements by conducting third-party risk assessments for new requests and annual reviews, suggesting process improvements as needed. Develop dashboards and publish periodic reporting on information security risks, internal control compliance, and audit/assessment findings to management. Provide guidance and support to other infosec team members and less experienced colleagues. Plan, design, and execute security assessment activities for mergers and acquisitions, providing regular status updates to stakeholders. Continuously improve the security control framework and look for automation opportunities to reduce manual efforts in processes. Perform regulatory and statutory audit compliance activities with timely completion.

Requirements

• You are knowledge-hungry when it comes to VDA and Web3, always eager to dive deeper and stay ahead in this evolving space.
• The world of Web3 and VDA excites you, fueling your curiosity and driving you to explore new opportunities within this dynamic landscape.
• You act like an owner, constantly striving for excellence, impact, and tangible results in everything you do.
• You embrace a We over Me mindset, growing individually while fostering the growth of those around you.
• Change is your catalyst, igniting your passion to build and innovate.
• You think outside the box, unbound by limitations or doubt, always pushing the boundaries of what's possible.
• 5-7 years of overall experience in the information security and privacy domain with 4 years of relevant experience in security and privacy.
• Strong knowledge and implementation experience of information security and privacy management frameworks, regulatory requirements, and applicable standards such as ISO 27001(ISMS), ISO 27701(PIMS), NIST CSF, GDPR, DPDPA, CCSS(CryptoCurrency Security Standard), etc.
• Strong demonstrated experience in conducting risk assessments, security assessments, internal audits, and facilitating/driving external audits.
• Solid experience in driving successful information security and privacy awareness programs, activities, and training across the organization.
• Strong knowledge and experience in security governance, risk management and compliance frameworks, and related activities.
• Ability to communicate effectively with technical and non-technical stakeholders.
• Strong team player and collaborative problem solver, committed to achieving shared team goals and fostering a positive work environment.
• Strong verbal, written communication, and interpersonal skills.
• Proficient in managing tasks under time constraints, ad-hoc work assignments, adept at independently reassessing priorities with attention to detail.
• Ability to deal with ambiguity and work towards the plan of action.
• Good knowledge of Cloud platforms such as AWS, Azure or GCP is an advantage.
• Prior working experience in Banking, Fintech or Big 4 GRC teams would be beneficial.

Key Skills

• ISO 27001
• ISO 27701
• NIST CSF
• GDPR
• DPDPA
• CRISC
• CISA
• CISSP
• Cloud platforms (AWS, Azure, GCP)

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.