Information Security Officer

True Tech Professionals; Goregaon; On-site; INR 900,000 - 1,500,000; Full time

Job summary

True Tech Professionals is seeking an Information Security GRC professional in Maharashtra, India. The role focuses on developing and maintaining information security policies, standards, and SOPs, while aligning with RBI, SEBI, IRDAI, and DPDP Act requirements.

The candidate will manage ISO 27001 implementation, ISMS documentation, risk assessments, and audits, coordinating internal and external reviews and reporting findings to management.

Qualifications

• 5-7 years of information security, GRC experience.
• Hands-on with ISO 27001, security audits, risk assessments, policy management.
• Familiarity with fintech/financial services regulatory frameworks.

Responsibilities

• Develop, review, and maintain information security policies, standards, procedures, and SOPs.
• Manage ISO 27001 implementation, ISMS documentation, risk assessments, and audit requirements.
• Coordinate internal and external security audits and track closure of audit findings.
• Ensure compliance with RBI, SEBI, IRDAI, and DPDP Act requirements.
• Maintain information security risk registers and prepare risk/compliance reports for management.
• Conduct third-party and vendor security risk assessments.
• Coordinate business continuity and disaster recovery documentation/testing.
• Conduct information security awareness sessions for employees.
• Collaborate with IT, Legal, Compliance, and business teams to address security risks and gaps.
• Support incident management, regulatory disclosures, and stakeholder communication.

Skills

Documentation

Analytical skills

Stakeholder management

GRC

Job description

Responsibilities

• Develop, review, and maintain information security policies, standards, procedures, and SOPs.
• Manage ISO 27001 implementation, ISMS documentation, risk assessments, and audit requirements.
• Coordinate internal and external security audits and track the closure of audit findings.
• Ensure compliance with applicable RBI, SEBI, IRDAI, and DPDP Act requirements.
• Maintain information security risk registers and prepare risk and compliance reports for management.
• Conduct third-party and vendor security risk assessments.
• Coordinate business continuity and disaster recovery documentation and testing.
• Conduct information security awareness sessions for employees.
• Collaborate with IT, Legal, Compliance, and business teams to address security risks and compliance gaps.
• Support incident management, regulatory disclosures, and stakeholder communication.

Requirements

• 5-7 years of relevant experience in Information Security, Governance, Risk & Compliance (GRC).
• Hands-on experience with ISO 27001, security audits, risk assessments, and policy management.
• Working knowledge of financial-sector regulatory frameworks.
• Experience coordinating internal and external audits and maintaining compliance documentation.
• Understanding of vendor risk management, business continuity, and information security controls.
• Strong documentation, analytical, and stakeholder management skills.
• Exposure to DPDP, PCI DSS, SOC 2, or other relevant compliance frameworks.
• Experience in fintech, banking, NBFC, or financial services.