Senior Consultant Information Security- ISO 27001 Implementer

Glan Management Consultancy; Gurugram District; On-site; INR 1,800,000 - 2,400,000; Full time

Job summary

Glan Solutions Gurgaon seeks a Senior Consultant Information Security – IT to lead ISMS implementation, ensure ISO 27001/27701 compliance, and coordinate risk management with IT and business units. You will manage audits, VAPT readiness, and security controls across endpoints, cloud, and networks.

The role requires 7+ years of relevant experience, deep knowledge of regulatory regimes, and strong communication to stakeholders. It is based in Gurgaon with direct reporting to the General Manager.

Qualifications

• Must have ISO 27001 Lead Implementer and ISO 27701 Lead Implementer certifications.
• In depth understanding of IT Act, DPDPA, Cert In regulations, CIS Controls as well as UK DPA and ISO 31000
• Good to have certification on CISM, CISSP and Cloud Security certifications (e.g., CCSK, CCSP).
• Familiarity with vulnerability scanning tools like Qualys and CSPM tools like Wiz.
• Lead IT DR drills and Tabletop exercises with internal IT teams.
• Hands on knowledge of security technologies (firewalls, EDR, SIEM, WAF, DLP, PAM).
• Ability to handle Endpoint, Perimeter, Cloud and Data Security consoles.
• Understand penetration testing types and MITRE ATT&CK framework.
• Knowledge of attack vectors and risk management frameworks.
• Strong technical writing and ability to train staff on security awareness.

Responsibilities

• Provide lead implementor support toward ISMS and PIMS policies and guides.
• Gather evidence of ISO 27001/27701 and IT Act compliance with audit logs and reviews.
• Conduct risk assessments for security tools and technologies with asset-threat-vulnerability analysis.
• Prioritize vulnerabilities and provide remediation recommendations to stakeholders.
• Develop and maintain an ongoing security project plan for audit gap remediation.
• Prepare regular reports on risk, GRC maturity, and security posture for stakeholders.
• Perform root cause analysis from security incidents and support IT staff in assessments.

Skills

ISO27001 Lead

ISO27701 Lead

CISM

CISSP

CCSP

Qualys

Wiz CSPM

IT Act/DPDPA

Firewalls

EDR

SIEM

DLP

PAM

GRC tools

Education

Bachelor’s degree in IT and Information Security

Tools

Qualys

Wiz

Job description

Job Title

Senior Consultant Information Security – IT

Job Purpose

Acting in a key technical management & execution capacity to provide a conduit between IT teams and key business stakeholders thereby ensuring information technology needs are managed consistently, following professional IT and global standards, and delivered with a high quality and customer satisfaction.

Reward Level

Middle Management

Job Location

Gurgaon

Experience

7 years Relevant Experience 7 years

Reporting to

General Manager

Qualification

Bachelor’s degree in IT and relevant Information Security

Key Deliverables

• Provide support as Lead implementor towards ISMS and PIMS policies, procedures, and guidelines and ensure to perform regular review and update.
• Gather evidence of continuous compliance with ISO 27001:2022 and ISO 27701:2019, DPDPA, IT Act and Cert In Regulation including audit logs, records of reviews, timely closure of open audit and risks and sharing the report with management.
• Conduct regular, documented information security and privacy risk assessments on Security Tools and Technologies by identifying assets, threats, vulnerabilities, likelihood, and impact.
• Prioritize identified vulnerabilities, detailed findings, remediation recommendations, trending reports on vulnerability posture towards closure with stakeholders.
• Implementation of a comprehensive, ongoing security project plan for remediation of open audit gaps.
• Prepare regular report on overall information security posture, GRC maturity, and risk landscape to relevant stakeholders
• Perform Root Cause Analysis and lessons learned from information security incidents, actively participate in audits and support internal IT staff to perform technical assessments and controls with evidence.

Key Relationships

• Internal IT and business customers .
• Global/Local IT Vendor, market and global (HQ) colleagues,
• Internal staff - direct reports (where applicable).
• IT vendors, contractors (where applicable).

Knowledge, Skills and Abilities

• Must have ISO 27001 Lead Implementer and ISO 27701 Lead Implementer certifications.
• In depth understanding of IT Act, DPDPA, Cert In regulations, CIS Controls as well as UK DPA and ISO 31000
• Good to have certification on CISM (Certified Information Security Manager), CISSP (Certified Information Systems Security Professional) and Cloud Security certifications (e.g., CCSK, CCSP, vendor-specific like AWS Security Specialty).
• Familiarity with common vulnerability scanning tools like Qualys (features, reporting, agent-based vs. network scans) and Cloud Security Posture Management (CSPM) tools like Wiz (cloud service provider configurations, misconfigurations, compliance checks in AWS, Azure, GCP).
• Conduct and lead IT DR drills and Tabletop exercises with internal IT teams.
• Hands on knowledge on common security technologies (e.g., firewalls, EDR, Cloud Security, VAPT tools, SIEM, WAF, DLP, PAM, BAS, encryption etc.,).
• Ability to handle and manage Endpoint, Perimeter, Cloud and Data Security technical consoles with configuration and fine tuning of policies.
• Understanding of various penetration testing types (e.g., network, web application, API, mobile, cloud) and methodologies.
• Knowledge of common attack vectors and exploitation techniques like MITREATTACK and DEFEND, NIST Cyber Security Framework
• Excellent technical writing skills for creating clear, concise, and comprehensive security policies, standards, and procedures.
• Ability to analyse complex risk data and present actionable insights.
• Proficiency with GRC platforms or tools for managing policies, risks, and controls
• Exceptional verbal and written communication skills to articulate complex security concepts to technical and non-technical stakeholders
• Strong technical skills to diagnose security issues, identify root causes, and develop effective solutions.
• Ability to develop and deliver engaging security training sessions and awareness campaigns to internal IT staff.
• Ability to stay updated with the latest security threats, vulnerabilities, technologies, and regulatory changes.