Program Manager-Security Operations & Compliance

Anovia; India; Remote; INR 1,800,000 - 2,400,000; Full time

Benefits offered by this job

Health Insurance

Wellness Program

Rewards & Recognition

Incentive Programs

Paid Leave

Learning Opportunities

Remote Work

Work-Life Balance

Immigration Support

Job summary

Anovia is seeking a hands-on information security and compliance professional to drive ISO/IEC 27001, SOC 2, HIPAA projects and audits. You will develop policies, controls, and evidence, coordinate meetings, and track actions while delivering security initiatives such as monitoring, vulnerability management, and establishing NOC/SOC capabilities.

The role blends governance with delivery, requiring initiative, planning and collaboration with auditors, vendors, and leadership to close findings and

Qualifications

• 4+ years in information security, IT compliance, GRC, security operations, or related field.
• Experience with ISO/IEC 27001, SOC 2, or comparable framework, including audit participation and remediation.
• Experience with GRC processes and tools for risk/controls, evidence, compliance tracking, and remediation.
• Familiarity with Microsoft 365 security suite and related capabilities (Defender, Intune, Entra ID).
• Ability to take ambiguous initiatives and drive them to completion with stakeholders and dependencies.
• Strong knowledge of information security principles, risk management, access control, vulnerability management, and incident response.
• Ability to collaborate with auditors, technical teams, and leadership.
• Bachelor's degree in relevant field or equivalent experience.

Responsibilities

• Maintain and develop ISMS (policies, procedures, controls, risks, evidence).
• Support ISO 27001, SOC 2, HIPAA and other initiatives.
• Coordinate internal/external audit activities and track actions.
• Maintain information asset inventory and data classification.
• Support identity/access management activities and least-privilege.
• Monitor and improve security tooling and processes (M365, Defender, Intune, Entra ID).
• Coordinate vulnerability identification, remediation, and escalation of findings.
• Coordinate third-party security assessments and contract reviews.
• Develop and maintain information security policies, standards, and SOPs.
• Coordinate security awareness training and phishing simulations.
• Support incident response, including containment and post-incident reporting.
• Support business continuity and disaster recovery planning.
• Lead initiatives from scope to implementation with stakeholders and owners.
• Serve as primary contact for auditors and coordinate with business/technical teams.

Skills

ISO/IEC 27001

SOC 2

GRC processes

Microsoft Defender

Intune

Entra ID

Audit coordination

Ambiguity management

Communication

Education

Bachelor's degree in Information Security/CS/IT

Tools

Microsoft Defender

Intune

Entra ID

GRC platforms (Secureframe/Vanta/Drata/OneTrust)

Job description

Anovia (formerly Innovatia Technical Services) is an industry-leading technology outsourcing support provider with expertise in the telecommunications industry. Operating for over 20 years, we specialize in workflow and knowledge processes, as well as technical support, helpdesk and multilingual support services. With over 200 professional experts across the globe, we service some of the worlds’ most successful Fortune 500 and Fortune 1000 companies.

About the Role

Anovia is looking for a hands-on information security and compliance professional with practical experience working with ISO/IEC 27001, SOC 2, HIPAA, or similar security and compliance programs.

The successful candidate will have experience helping an organization prepare for and work through an audit or certification process, including developing and maintaining policies and controls, supporting evidence collection, coordinating activities and meetings, tracking actions, and working with internal and external auditors.

This is also a build and delivery role. Anovia has a number of technical and operational initiatives that require more structure, planning, coordination, and follow-through. The successful candidate will be comfortable taking an initiative that is not yet well defined, establishing a practical plan, coordinating the people involved, and driving the work through to completion. Examples could include implementing a new security tool, improving security monitoring or vulnerability management, or helping establish a NOC/SOC capability.

Responsibilities

• Maintain and continue to develop Anovia's ISO/IEC 27001 Information Security Management System (ISMS), including policies, procedures, controls, risks, objectives, evidence, and ongoing improvement activities.
• Support ISO 27001, SOC 2, HIPAA, and other security and compliance initiatives as they are introduced and developed.
• Coordinate internal and external audit activities, including preparing evidence, scheduling and facilitating meetings, maintaining action items, and ensuring audit findings and resulting actions are addressed.
• Maintain the information asset inventory and data classification program, including assigning and tracking ownership.
• Support identity and access management activities, including provisioning and de-provisioning, access reviews, least-privilege requirements, and privileged access controls.
• Monitor and improve security tooling and processes, including Microsoft 365 security capabilities, Microsoft Defender, Intune, Entra ID, security monitoring, endpoint protection, and vulnerability management.
• Coordinate vulnerability identification, remediation tracking, and escalation of significant findings.
• Coordinate third-party and vendor security assessments, including security questionnaires and contract review support.
• Develop, maintain, and support adoption of information security policies, standards, and operating procedures.
• Coordinate security awareness training and phishing simulation programs.
• Support security incident response activities, including detection, containment, investigation, root-cause analysis, and post-incident reporting.
• Support business continuity and disaster recovery activities, including maintenance of recovery requirements, testing, and related evidence.
• Lead or coordinate technical and operational initiatives from initial scope through implementation, establishing plans, identifying dependencies and owners, coordinating stakeholders, tracking risks and issues, and driving work to completion.
• Serve as a primary point of contact for internal and external auditors and coordinate responses with relevant business and technical stakeholders.

Required Qualifications

• 4+ years of progressively responsible experience in information security, IT compliance, GRC, security operations, or a related field.
• Practical experience working with ISO/IEC 27001, SOC 2, or a comparable security and compliance framework. Experience should include meaningful participation in an audit or certification process and familiarity with activities such as policy development, control implementation, evidence collection, audit preparation, management meetings, action tracking, and remediation.
• Experience with GRC processes and tools, including risk and control management, evidence collection, compliance tracking, audit preparation, and remediation or corrective-action management.
• Working experience with the Microsoft 365 security environment, including familiarity with Microsoft Defender, Intune, Entra ID, and related security and compliance capabilities.
• Demonstrated ability to take an ambiguous technical or operational initiative and bring structure to it, including defining scope, developing a practical plan, coordinating stakeholders, managing dependencies and issues, and driving the work through to completion.
• Working knowledge of information security principles, risk management, access control, vulnerability management, incident response, and security awareness.
• Comfortable working directly with auditors, technical teams, business stakeholders, vendors, and leadership.
• Strong organizational and communication skills, with the ability to manage multiple ongoing activities and follow through on commitments.
• Bachelor's degree in Information Security, Computer Science, IT, or a related field, or equivalent practical experience.

Nice to Have

• Experience with HIPAA Security and Privacy Rule requirements or other healthcare security and privacy requirements.
• Experience with GRC platforms such as Secureframe, Vanta, Drata, or OneTrust.
• Experience with SIEM, EDR/endpoint protection, vulnerability scanners, or related security tooling beyond the Microsoft 365 environment.
• Experience with NIST CSF or other complementary security frameworks.
• Experience managing contractors or vendors during technical or security initiatives.
• Experience helping establish or improve security monitoring, NOC, SOC, or similar operational capabilities.
• Experience with business continuity and disaster recovery planning.

Certifications

Certifications are useful supporting evidence of knowledge, but are not a substitute for practical experience. Relevant certifications include:

• ISO/IEC 27001 Lead Implementer or Lead Auditor
• CISA (Certified Information Systems Auditor)
• CISSP (Certified Information Systems Security Professional)
• CISM (Certified Information Security Manager)

Relevant certifications are preferred but not require

Benefits at Anovia

• Comprehensive Health Insurance policy
• Employee Wellness Program with focus on mental health
• Robust reward and recognition programs
• Company incentive programs offered
• Attractive leave policy: Holiday Leave, Maternity Leave, Paternity Leave, Birthday leave, Bereavement Leave and Paid Leave for personal time off
• Ample growth and learning opportunities
• Remote work opportunities
• Focus on work/life balance
• Immigration Program supporting immigration to Canada for eligible employees

We thank all candidates for their interest, however, only those selected for an interview will be contacted.
Anovia is an equal opportunity employer.