Senior InfoSec Engineer

Jobgether; Inde; À distance; INR 2 000 000 - 4 000 000; Plein temps

Avantages offerts par ce poste

Fully remote working arrangement

Global team collaboration

Professional development

Résumé du poste

Jobgether in India is seeking a Senior InfoSec Engineer to strengthen governance, risk, and compliance across a global organization. You will assess controls, test design and operating effectiveness, and help ensure policy alignment with NIST and ISO standards.

You will collaborate with security teams, control owners, and business stakeholders to identify risks, document evidence, and support remediation, audits, and ongoing improvements across GRC processes.

Qualifications

• Bachelor's degree in Computer Science, Information Security, Engineering, Risk Management, or related field, or equivalent professional experience.
• 7+ years of Information Security experience with GRC, controls, auditing, or assurance.
• Hands-on experience evaluating security controls, design and operating effectiveness.
• Knowledge of control testing methodologies, evidence evaluation, sampling, and documentation.
• Familiarity with NIST CSF, ISO/IEC 27001, and ISO/IEC 27002.
• Understanding of IAM, vulnerability management, network security, data protection, logging, and incident response.
• Experience with policy exceptions, risk acceptance, issue management, remediation tracking, or related governance activities.
• Experience using GRC platforms and ServiceNow is an advantage.

Responsabilités

• Perform security control assessments evaluating design and operating effectiveness.
• Develop and execute structured testing procedures and evidence requirements.
• Review security documentation and evidence to verify proper design and functioning controls.
• Collaborate with control owners and security specialists to gather evidence and communicate findings.
• Support multi-entity GRC assessments across applicable business entities.
• Manage policy exception processes and risk assessment inputs.

Connaissances

GRC principles

Control testing

Risk assessment

NIST CSF

ISO 27001

Policy management

Clear communication

Formation

Bachelor's degree in CS/InfoSec

Outils

ServiceNow

Evidence management tools

GRC platforms

Description du poste

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Senior InfoSec Engineer based in India.

As a Senior InfoSec Engineer, you will play a critical role in strengthening information security governance, risk management, and compliance across a complex international organization. You will focus on assessing and testing security controls, evaluating their design and operational effectiveness, and ensuring alignment with established security policies and industry standards. Working closely with Information Security teams, control owners, technical experts, and business stakeholders, you will identify potential risks, assess control gaps, and support effective remediation initiatives. You will also contribute to risk assessments, policy exception management, and continuous improvements across governance processes. Using established frameworks such as NIST and ISO 27001, you will help maintain a strong and consistent security posture while ensuring audit readiness. This is an opportunity to take ownership of meaningful security initiatives within a collaborative, global, and technology-driven environment.

Accountabilities:

• Perform security control assessments: Conduct comprehensive information security control assessments, evaluating both design effectiveness and operating effectiveness across established security controls.
• Develop and execute testing procedures: Create and implement structured control testing methodologies, define evidence requirements, evaluate control populations and samples, and document clear assessment conclusions.
• Review security documentation and evidence: Examine policies, standards, procedures, system-generated reports, screenshots, tickets, and other supporting documentation to determine whether security controls are properly designed and functioning as intended.
• Collaborate with control owners: Work closely with Information Security specialists, technical subject matter experts, and control owners to clarify control requirements, collect supporting evidence, validate exceptions, and communicate assessment findings.
• Support multi-entity assessments: Contribute to Multi-Brand Entity (MBE) control assessments by reviewing security control implementation and supporting evidence across applicable business entities.
• Manage policy exception processes: Support the Policy Exception Request (PER) lifecycle, including reviewing exception requests, coordinating with stakeholders, providing risk assessment inputs, monitoring progress, and ensuring appropriate closure.
• Conduct information security risk assessments: Identify and evaluate security risks by assessing inherent risk, likelihood, potential impact, residual risk, and relevant mitigating controls using established methodologies.
• Apply security frameworks and standards: Interpret and implement information security policies, standards, and control requirements, referencing frameworks such as NIST Cybersecurity Framework (CSF), ISO/IEC 27001, and ISO/IEC 27002.
• Maintain audit-ready documentation: Prepare and maintain accurate assessment workpapers, supporting evidence, control testing records, and documentation required for internal and external audit activities.
• Monitor remediation activities: Track identified control gaps, remediation actions, deadlines, and outstanding issues while supporting governance reporting and follow-up activities.
• Drive continuous improvement: Identify opportunities to improve GRC processes, data quality, reporting, workflow automation, and overall assessment efficiency.
• Support security governance initiatives: Collaborate with India-based and U.S.-based teams, providing clear, timely, and evidence-based updates to GRC leadership and Information Security stakeholders.

Requirements:

• Bachelor's degree in Computer Science, Information Security, Engineering, Risk Management, or a related discipline, or equivalent relevant professional experience.
• At least 7 years of professional experience in Information Security, with relevant expertise in Governance, Risk & Compliance (GRC), security controls, auditing, or assurance activities.
• Hands-on experience conducting information security control assessments and testing, including evaluating control design and operating effectiveness.
• Strong understanding of control testing methodologies, including evidence evaluation, sampling techniques, control populations, test procedures, exception identification, and assessment documentation.
• Practical knowledge of information security risk management principles, including risk identification, likelihood, impact, inherent risk, residual risk, mitigating controls, and risk treatment.
• Experience interpreting and applying information security policies, standards, procedures, and internal control requirements.
• Familiarity with industry frameworks and standards, particularly NIST Cybersecurity Framework (CSF), ISO/IEC 27001, and ISO/IEC 27002.
• Understanding of key Information Security domains, including Identity and Access Management (IAM), vulnerability management, network security, endpoint security, data protection, logging and monitoring, incident response, business continuity, and third-party security.
• Previous experience supporting policy exceptions, risk acceptance processes, issue management, remediation tracking, or similar governance activities is highly desirable.
• Experience using GRC platforms, workflow management solutions, ticketing systems, or evidence management tools. Familiarity with ServiceNow or similar platforms is an advantage.
• Strong analytical and critical-thinking skills, with the ability to identify security weaknesses, evaluate complex information, and develop practical recommendations.
• Excellent documentation and organizational skills, with exceptional attention to detail and the ability to maintain accurate, audit-ready records.
• Strong written and verbal communication skills, including the ability to work effectively with technical experts, control owners, business stakeholders, and international teams.
• Ability to manage multiple assessments and governance activities simultaneously, follow established methodologies, meet deadlines, and escalation issues appropriately.

Preferred certifications:

• Certified Information Systems Auditor (CISA).
• Certified in Risk and Information Systems Control (CRISC).
• Certified Information Systems Security Professional (CISSP).
• ISO/IEC 27001 certification.
• Other relevant Information Security, risk management, or GRC certifications.

Benefits:

• Fully remote working arrangement.
• Full-time employment within an established international organization.
• Opportunity to contribute to enterprise-wide information security and risk management initiatives.
• Exposure to global security governance practices and internationally recognized frameworks.
• Collaboration with experienced Information Security professionals and stakeholders across India and the United States.
• Opportunities to strengthen expertise in cybersecurity, compliance, risk assessment, and security assurance.
• Professional development opportunities through relevant training and industry certifications.
• Inclusive and collaborative working environment that values diversity, integrity, teamwork, and individual contributions.
• Opportunity to work with innovative technologies and contribute to the continuous improvement of enterprise security practices.