Sr. Information Security Engineer

We are seeking a proactive and detail-oriented Information Security Engineer to join our Infosec team. The ideal candidate is a hands-on technical professional who will play a strategic and operational role in defining, implementing, and maintaining our organization's security posture. This role is centred on protecting our information assets by interpreting and implementing security mandates from various regulatory bodies in India (including RBI, IRDAI, SEBI, and NPCI). You will be responsible for assessing and mitigating risks associated with these frameworks, ensuring continuous technology compliance across all business units.

Your ability to bridge the gap between technical controls and regulatory requirements will be key to your success. You will work closely with engineering, infrastructure, legal, and IT teams to establish and maintain robust security operations, policies, and controls. Your efforts will be crucial in ensuring a secure and compliant foundation that enables the business to operate efficiently and with confidence.

Responsibilities:

• Facilitate the development and implementation of advanced information security risk management frameworks to effectively identify, assess, and mitigate potential risks within the organization's infrastructure and operations.
• Conduct thorough assessments to identify vulnerabilities with external and internal teams, ensuring compliance with internal policies and external regulations.
• Collaborate with internal and external auditors to facilitate audits, including but not limited to IS audits, cyber audits, system audits, and VAPT for the group entities and manage required remediations to ensure regulatory submissions are compliant.
• Contribute to the evolution of information security policies and procedures, ensuring that they support effective risk management and adherence to relevant regulations and standards.
• Collaborate closely with IT, legal, and cross-functional teams to integrate risk management and compliance measures into business processes, aligning with organisational objectives.
• Maintain detailed documentation of risk management activities, compliance audits, and GRC policies, ensuring accuracy and transparency to support accountability.
• Oversee responses to security-related incidents, ensuring prompt and effective remediation while monitoring for emerging risks and opportunities for improvement.
• Provide expert guidance on GRC and regulatory initiatives, staying informed about industry trends, technologies, and regulatory changes.
• Share knowledge and best practices with team members and stakeholders.

Requirements:

• 3-5 years of experience
• Bachelor's degree in Information Security, Business Administration, or a related field.
• Experience in third-party risk management, overall governance, risk and regulatory compliance of capital market business.
• Strong understanding of the implementation of regulatory compliance requirements, technical reviews, products of capital market like backoffice and legal contract reviews.
• Advanced knowledge of security and risk management frameworks and standards (e. g., NIST, ISO 27001,27701).
• Proficiency in data analysis, risk management tools, and reporting platforms.
• Strong leadership and project management skills, with experience managing cross-functional teams and large-scale initiatives.
• Exceptional interpersonal and communication skills, with a proven ability to build relationships with senior stakeholders.
• Experience with automation and scripting for risk management processes.
• Ability to design and implement comprehensive GRC architectures and frameworks.
• Preferred: Certifications such as CRISC, CISA, ISO 27K LA or similar are a plus.
• Knowledge of Master Directions and circulars of RBI, SEBI, NSE, BSE, CDSL is a plus.
• Experience with Indian Fintech is a plus.
• Experience with automation tools or platforms used for risk identification and monitoring.
• Ability to design and implement comprehensive GRC architectures and frameworks.
• Familiarity with ISO 27001, NIST, SOC 2, or other security and compliance frameworks.