Role Proficiency:With strong knowledge of various applicable compliance standards independently handle internal/external compliance audits and VAPT/Red Teaming assignments. Involve more in the risk assessment and remediations and in customer assurance activities. Independently handle all the assigned tasks with minimal supervision.
- Handle the assigned tasks from the allocated domain with minimal guidance from the leads. (Domain Examples: BCMS Risk assessment incident management HITRUST SOC customer assurance Awareness activities Data Privacy VAPT Red Teaming etc.)
- Independently handle (with very minimal guidance from the supervisors) internal/external audits to ensure compliance with ISO 27001/ISO 22301/ISO 27701 requirement as well as process specific requirements
- Responsible for the effective documentation of internal audits(reports) individually.
- Responsible for effective external audit facilitation Preparing CAPA and ensure the readiness for external audits.
- Point out the non-conformance areas and suggest measures to improve the information security individually.
- Ensure that risk management is effectively conducted across the organization business processes and information systems.
- Involve and contribute to customer assurance activities.
- Coordinate information security awareness training programs for all the employees contractors and approved system users.
- Coordinate and Review the technical vulnerability assessments of IT systems and processes to identify potential vulnerabilities. Submit recommendations to control any risks identified and ensure that they are implemented.
- Perform Security Architecture and Configuration reviews on various IT systems.
- Involve and contribute to process automation.
- Design plan and execute the Cybersecurity activities.
- Directly Interact with customer and communicate detailed technical requirement to the team.
- Use independent judgement and discretion to analyse the system security.
- Prepare detailed description of user requirements and steps required to perform the VAPT/Red Teaming.
- Learn and understand existing and emerging management practices.
- Independently handle the evidence collection from multiple teams as part of any external audits.
- Policy/Procedure creation activities and process improvement ideas to be implemented.
- Research and analytical skills including the ability to convert complex policy issues into simple briefings and communicate to the audience.
- Mentor A band employees
Measures of Outcomes:
- Number of internal audits and security assessments conducted per year.
- Number of external audit facilitation activities.
- Number of other location responsibilities.
- Number of Threats/Risks/Vulnerabilities reported per year.
- Number of NCs in external audits on assigned domains.
- Areas of responsibility on cross domains.
- Performance of ISMS/BCMS/PIMS/QMS in the responsible centre/regions.
- Awareness activities conducted and the percentage of adoption in the responsible centre/regions.
- Noticeable initiatives taken to improve the process.
- Less than two stake holder escalations.
- More than three appreciation from the stakeholders/supervisors.
- Policy and Procedure creations
Awareness training materials
Presentations decks for internal/ external discussions
Audit /Security Assessment reports
- Internal ISMS audits - independently carry out audits
prepare audit reports and ensure timely closure of audit reports
- Compliance Audits - Readiness for audits
representation in certification audits
- Risk Assessment - IT Controls' implementation and assess risks
- Infosec activities - training material
co-ordinate with other teams for trainings conducting
- Customer Assurance - Involve and handle customer assurance activities
- Policy - Identify discrepancies in the policies and addressing it
- Vulnerability Assessment and Penetration Testing/Red Teaming Activities
- CM activities
- Executing other location responsibilities
- Involve and contribute to the process automations
- Mentoring and leading A band employees
Training or certifications:
- 2 per year (on responsible domains)
- Ability to understand prioritize and escalate tasks to resolve issues quickly and make decisions
- Able to interpret all scenarios applicable to the business for identifying the potential risks associated with various functions/services.
- Proficiency in Network Security Controls' implementation like IAM IPS/IDS E-Mail Security Controls Cloud Security Controls etc.
- Proficiency in Security Architecture and configuration reviews.
- Proficiency in Technical Vulnerability Assessment and Management.
- Strong compliance auditing knowledge.
- Detail oriented customer oriented result delivery oriented analytical thinking
- Development or Testing experience is an added advantage.
- Strong in networking concepts.
- Strong Excel and Dashboard skills.
- Excellent Presentation and communication skills
- Excellent verbal and written communication skills required including the ability to effectively communicate in both highly technical and non-technical environments
- A great problem solver with the knack of coaching others to do the same
- Good at working in a team and with other teams
- Good time management
- A desire for continuous learning and skill development.
- Self-motivated and enthusiastic
Knowledge Examples: Should have a strong knowledge of Information Security Business Continuity Data Privacy standards VAPT Red Teaming and various compliance standards.
- Knowledge on ISO and other Compliance standards efficient to evaluate the security controls.
- Knowledge on ISO 22301/27001/9001/27701 Risk Management incident management awareness activities customer assurance etc.
- Knowledge on standard SDLC and project management life cycles.
- Knowledge on the operations of various functional units like HR REFM IT Finance etc. and units involved in IT Asset lifecycle management.
- Expert on security testing standards like OWASP Top 10 SANS 25 etc.
- Good at OWASP cheat sheets and other security frameworks.
- Expert on Linux commands.
- Expert on Scripting Languages like Shell Script Python etc.
- Development and Testing knowledge would an added advantage.
- Hands on experience in RSA Archer Postman Burp Suite Nessus Nmap Genymotion MobSF Drozer etc.
- Good to have Certifications like ISO 27001/22301/9001/27701 Lead Auditor CISM CCSP CCSK DCPP CPENT LPT OSWE etc.
Title: Internal Audit Lead (Senior position) Reporting Supervisor: CISO Primary Duties: a) Schedule, coordinate, and lead company internal audits. b) Provide audit guidance to functional teams and ensure audit preparedness. c) Provide recommendations for corrective actions to ensure that audit findings are closed in compliance with audit requirements. d) Track audit findings and corrective actions to closure. e) Manage and provide reporting to executive leadership and functional team leads on audit status and progress to closure. f) Collect evidence for audits in compliance tool in coordination with the Compliance Manager. g) Provide audit project management. h) Support preparation for external audits, liaise with external auditors, and provide internal guidance in support of external audits. Skills and Experience Requirements: a) Training and two (2) years' experience in Information Security and Information Security based compliance audits (Examples include: ISO 27001, 27002, 27701, 27017, 31000, 27005, NIST 800-30, 800-53, GDPR, HIPAA, etc.). b) Fluent in English (reading, writing, and conversational). c) Minimum one (1) year working with international teams. d) Minimum one (1) year working in Privacy related compliance. e) Ability to quickly learn CyberProof organization, service offerings, and business model. Additional Preferred Skills: a) Certifications in CISSP, CISA, CIPP, ISO27001 Lead Implementor or Lead Auditor. b) Previous experience in an audit firm. c) Previous experience in a Managed Security Services Provider organization.
JOB DESCRIPTION Role Proficiency:With strong knowledge of various applicable compliance standards independently handle internal/external compliance audits and VAPT/Red Teaming assignments. Involve more in the risk assessment and remediations and in
Experience: 0.00-50.00 Years