Information Security Manager

Altraize; Mumbai; On-site; INR 223,200 - 334,800; Full time

Job summary

A leading information security firm in Mumbai is seeking an experienced professional to establish and manage their Information Security Management System (ISMS) in compliance with ISO 27001 standards. The role involves leading ISO 27001 audits, developing information security policies, conducting risk assessments, and ensuring compliance with data protection regulations. The ideal candidate should have a strong background in network engineering, security monitoring tools, and knowledge of ISO 27001 implementation along with excellent analytical and communication skills.

Qualifications

• Strong understanding of network engineering, firewalls, endpoint protection, and security monitoring tools.
• Practical knowledge of Windows/Linux server hardening, Active Directory, and cloud security controls (AWS/Azure).
• Sound understanding of information security risk management, business continuity, and incident response.
• Experience in ISO 27001:2022 implementation, audit, or maintenance.
• Excellent analytical, documentation, and communication skills.

Responsibilities

• Establish, implement, and maintain ISMS in line with ISO 27001 standards.
• Lead ISO 27001 audits, manage corrective actions, and ensure compliance.
• Develop and enforce information security policies, procedures, and controls.
• Conduct risk assessments and manage the risk treatment plan.
• Ensure compliance with data protection and privacy regulations.
• Design and manage secure network architecture and access control systems.
• Configure, monitor, and maintain firewalls and intrusion prevention systems.
• Oversee deployment of antivirus and data loss prevention tools.
• Perform regular vulnerability assessments and coordinate remediation.
• Manage patch management and secure configuration processes.
• Establish and maintain a Security Operations framework.
• Lead investigation of security incidents.
• Implement and monitor SIEM solutions.
• Conduct information security awareness sessions for employees.
• Review vendor security posture for compliance.
• Maintain updated inventory of information assets.

Skills

Network engineering

Firewalls

Endpoint protection

Security monitoring tools

Windows/Linux server hardening

Active Directory

Cloud security controls (AWS/Azure)

Information security risk management

Business continuity

Incident response

Analytical skills

Documentation skills

Communication skills

Education

Bachelor’s degree in Computer Science / IT / Information Security or related field

Tools

CISSP

CISM

CEH

CCNP Security

Fortinet NSE

ISO 27001 Lead Implementer / Lead Auditor certification

Job description

Overview

Role to establish and maintain the organization’s Information Security Management System (ISMS) per ISO 27001, lead ISO 27001 audits, develop and enforce information security policies, conduct risk assessments, ensure data protection compliance, and build a security program across the organization.

Responsibilities

• Establish, implement, and maintain the organization’s Information Security Management System (ISMS) in line with ISO 27001 standards.
• Lead ISO 27001 audits (internal & external) — coordinate with auditors, manage corrective actions, and ensure ongoing compliance.
• Develop and enforce information security policies, procedures, and controls across all business units.
• Conduct risk assessments and manage the risk treatment plan.
• Ensure compliance with data protection and privacy regulations (e.g., GDPR, IT Act).
• Network and Infrastructure Security — design and manage secure network architecture, VLANs, VPNs, and access control systems.
• Configure, monitor, and maintain firewalls (e.g., Sophos) and intrusion prevention systems (IPS/IDS).
• Oversee deployment and management of antivirus, endpoint protection, and data loss prevention (DLP) tools.
• Perform regular vulnerability assessments and coordinate remediation with infrastructure teams.
• Manage patch management, secure configuration, and change management processes.
• Establish and maintain a Security Operations framework — including incident response plans and escalation protocols.
• Lead investigation of security incidents and root cause analysis.
• Implement and monitor SIEM solutions and log management systems to detect and respond to threats proactively.
• Awareness & Training — conduct information security awareness sessions for employees and vendors; build a culture of security across departments through campaigns and refresher trainings.
• Review vendor security posture and ensure compliance with company standards.
• Maintain updated inventory of information assets, along with classification and ownership details.

Qualifications and Skills

• Strong understanding of network engineering, firewalls, endpoint protection, and security monitoring tools.
• Practical knowledge of Windows/Linux server hardening, Active Directory, and cloud security controls (AWS/Azure).
• Sound understanding of information security risk management, business continuity, and incident response.
• Experience in ISO 27001:2022 implementation, audit, or maintenance.
• Excellent analytical, documentation, and communication skills.

Preferred Qualifications

• Bachelor’s degree in Computer Science / IT / Information Security or related field.
• ISO 27001 Lead Implementer / Lead Auditor certification (preferred).
• Certifications such as CISSP, CISM, CEH, CCNP Security, Fortinet NSE, or equivalent will be an advantage.