Opening for Information Security Specialist @ Mumbai

Quess IT Solutions; Mumbai; On-site; INR 1,200,000 - 1,800,000; Full time

Job summary

Quess IT Solutions is seeking a cybersecurity GRC consultant with 3+ years of experience in information security, risk advisory, or IT audit. The role involves working directly with clients in advisory and audit capacities, implementing ISO/IEC 27001, conducting risk assessments, and ensuring certification-readiness.

The ideal candidate will have strong knowledge of NIST frameworks, data privacy laws (DPDPA, GDPR), and regulatory expectations from RBI, SEBI, and IRDAI, with experience in

Qualifications

• 3+ years of relevant experience in cybersecurity GRC consulting, information security consulting, IT audit, risk advisory, compliance, or related roles.
• Demonstrated experience working directly with clients in a consulting, advisory, audit, or assurance capacity.
• Hands-on experience in ISO/IEC 27001 implementation, gap assessment, internal audit, risk assessment, control documentation, or certification-readiness engagements.
• Strong understanding of NIST cybersecurity frameworks and their practical application in assessment and improvement programs.
• Working knowledge of DPDPA, GDPR, data privacy governance, data lifecycle controls, consent management concepts, data-subject rights, and privacy risk assessments.
• Experience with RBI, SEBI, and IRDAI cybersecurity and regulatory expectations; experience supporting BFSI clients will be preferred.
• Experience in Third-Party Risk Management, including vendor security assessments, supplier due diligence, risk classification, and remediation follow-up.
• Experience in cybersecurity posture assessments, cyber maturity assessments, cyber risk assessments, and compliance gap assessments.
• Familiarity with SOC 2 Type II requirements, Trust Services Criteria, control mapping, audit evidence, and readiness activities.
• Strong capability in developing and reviewing cybersecurity policies, standards, procedures, risk registers, control matrices, and compliance documentation.
• Experience in conducting cybersecurity training and awareness initiatives.
• Ability to interpret regulatory and framework requirements and translate them into practical, measurable, client-specific controls.
• Strong report-writing, documentation, presentation, stakeholder-management, and client communication skills.

Job description

3+ years of relevant experience in cybersecurity GRC consulting, information security consulting, IT audit, risk advisory, compliance, or related roles.

• Demonstrated experience working directly with clients in a consulting, advisory, audit, or assurance capacity.
• Hands-on experience in ISO/IEC 27001 implementation, gap assessment, internal audit, risk assessment, control documentation, or certification-readiness engagements.
• Strong understanding of NIST cybersecurity frameworks and their practical application in assessment and improvement programs.
• Working knowledge of DPDPA, GDPR, data privacy governance, data lifecycle controls, consent management concepts, data-subject rights, and privacy risk assessments.
• Experience with RBI, SEBI, and IRDAI cybersecurity and regulatory expectations; experience supporting BFSI clients will be preferred.
• Experience in Third-Party Risk Management, including vendor security assessments, supplier due diligence, risk classification, and remediation follow-up.
• Experience in cybersecurity posture assessments, cyber maturity assessments, cyber risk assessments, and compliance gap assessments.
• Familiarity with SOC 2 Type II requirements, Trust Services Criteria, control mapping, audit evidence, and readiness activities.
• Strong capability in developing and reviewing cybersecurity policies, standards, procedures, risk registers, control matrices, and compliance documentation.
• Experience in conducting cybersecurity training and awareness initiatives.
• Ability to interpret regulatory and framework requirements and translate them into practical, measurable, client-specific controls.
• Strong report-writing, documentation, presentation, stakeholder-management, and client communication skills.
• Candidates must hold any of the following valid certifications: