Senior Manager Information Security

Nusummit; Mumbai; On-site; INR 2,500,000 - 4,000,000; Full time

Job summary

Nusummit is seeking a Senior Manager - GRC (Cybersecurity) to lead and coordinate governance across ISO 27001, ISO 14001 and support SOC 2 and other frameworks. The role focuses on driving information security risk assessments, control effectiveness and compliance monitoring.

You will lead audits, manage third-party security requirements, and govern data protection, data classification and security monitoring, while partnering with multiple teams to strengthen the organization’s overall security

Qualifications

• Lead ISO 27001/ISO 14001 programs and support SOC 2 and other frameworks.
• Drive information security risk assessments and risk treatment.
• Oversee audits—internal, external, surveillance, customer and third-party.
• Manage customer security assessments and contractual security requirements.

Responsibilities

• Govern third-party risk management including vendor assessments and remediation.
• Provide governance over SOC, SIEM, EDR, DLP and security monitoring.
• Drive data protection, data classification and prevention of leakage.
• Oversee asset inventory and security monitoring for critical IT and cloud assets.
• Support cloud security and AI governance and related risks.
• Develop and maintain security policies, standards, controls and reporting.
• Lead cybersecurity awareness and training programs across the organization.
• Partner with IT, HR, Legal, Procurement, customers and auditors to strengthen security posture.

Skills

ISO 27001

ISO 14001

SOC 2

Risk assessments

Audits

Vendor security

Job description

Job Role: Senior Manager - GRC (Cybersecurity)

• Lead and maintain ISO 27001, ISO 14001 and support SOC 2 and other compliance frameworks.
• Drive information security risk assessments, risk treatment, control effectiveness, and compliance monitoring.
• Lead internal, external, surveillance, customer, and third-party security audits and ensure timely closure of findings.
• Manage customer security assessments, due diligence questionnaires, and contractual security requirements.
• Govern Third-Party Risk Management (TPRM), including vendor security assessments, contractual controls, and remediation.
• Provide governance oversight for SOC, SIEM, EDR, DLP, Vulnerability management and security monitoring.
• Drive data protection and DLP governance, including information classification and prevention of data leakage.
• Oversee asset inventory and security monitoring coverage for critical IT and cloud assets.
• Govern VAPT, vulnerability remediation, access reviews, privileged access, and security control assessments.
• Support cloud security and emerging technology/AI governance, including security and data protection risks.
• Develop and maintain security policies, procedures, standards, controls, and management reporting.
• Lead cybersecurity awareness and training programs across employees and stakeholders.
• Support incident management, business continuity, disaster recovery, and security improvement initiatives.
• Partner with IT, SOC, HR, Legal, Procurement, Business teams, customers, vendors, and auditors to strengthen the organization's overall security posture.