Specialist Cybersecurity - IT Audit Management (PCI DSS audits, SOC and ISO 27001)/Risk assessments, information security compliance, or IT security operations.

AT&T; Bengaluru; On-site; INR 900,000 - 1,300,000; Full time

Job summary

AT&T seeks a Specialist – Audit Management (PCI, SOC and ISO 27001) to join the Technology Risk Management team in Bengaluru/Hyderabad. The role requires 5+ years of IT audits, risk assessments, and information security expertise, including leading ISO 27001, SOC, and PCI audits.

You will coordinate complex audit programs, manage external/internal stakeholder communications, and drive continuous improvement in governance, risk, and compliance processes.

Qualifications

• Minimum 3 years of experience in IT audits, risk assessments, information security compliance, or IT security operations.
• Experience leading ISO 27001, SOC, PCI audits (2+ years).
• Strong understanding of cybersecurity frameworks (NIST, ISO 27001, CIS Controls).
• Excellent project management and communication skills.

Responsibilities

• Develop and maintain audit plans including PCI DSS audits with defined scope, objectives and timelines.
• Maintain end-to-end audit process documentation and flows for internal and external audits.
• Lead annual COA process and readiness activities ahead of SOC audits.
• Facilitate PCI DSS audits end-to-end with evidence collection, interviews and testing support.
• Coordinate between external auditors and internal Data/Control Owners; schedule interviews and fieldwork.
• Manage audit inquiries, follow-ups, and ensure confidentiality of sensitive information.
• Review preliminary findings and coordinate remediation actions and closure verification.
• Provide weekly and monthly audit status reports and conduct status meetings to drive resolution.
• Drive continuous improvement and audit readiness through training and post-audit reviews.

Skills

IT audits

Risk assessments

Information security

Cybersecurity frameworks

Education

ISO 27001 Lead Auditor/Implementer

CISSP

CISM

CRISC

CISA

Job description

Role: Specialist – Audit Management (PCI, SOC and ISO 27001)

Join AT&T and reimagine the communications and technologies that connect the world. Our Chief Security Office ensures that our assets are safeguarded through truthful transparency, enforce accountability and master cybersecurity to stay ahead of threats. Bring your bold ideas and fearless risk-taking to redefine connectivity and transform how the world shares stories and experiences that matter. When you step into a career with AT&T, you won\'t just imagine the future-you\'ll create it.

About the Company:

Join AT&T and reimagine the communications and technologies that connect the world. Our Chief Security Office ensures that our assets are safeguarded through truthful transparency, enforce accountability and master cybersecurity to stay ahead of threats. Bring your bold ideas and fearless risk-taking to redefine connectivity and transform how the world shares stories and experiences that matter. When you step into a career with AT&T, you won\'t just imagine the future-you\'ll create it.

About the Job:

The Technology Risk Management team is part of Chief Security Office (CSO) and responsible for managing multiple teams that facilitate external audits, internal audits, analyze policy exceptions, conduct risk assessments, and run enforceable governance across processes. They work closely with the AT&T Technology Services (ATS) teams, Cyber Security Risk Management (CSRM) teams and other CSO teams to ensure effective and efficient GRC processes. Below are the key responsibilities of the Specialist – Audit Management position:

• Develop and maintain comprehensive internal and external audit plans, including PCI DSS audits, ensuring scope, objectives, deliverables, activities, owners, timelines, and dependencies are clearly defined, assigned, tracked, and completed in a timely manner.
• Maintain end-to-end audit process documentation and process flows for internal and external audits, ensuring procedures, roles, responsibilities, and supporting documentation remain current and clearly defined.
• Lead the annual Control Owner Assertion (COA) process, ensuring completion at least six weeks before the start of the internal audit cycle (SOC), and drive readiness activities with Data and Control Owners.
• Develop and facilitate audit kick-off activities, including presentations, timelines, communication protocols, expectations, and audit-request templates; finalize materials at least two weeks before kick-off and ensure external auditor requests are clearly documented in advance.
• Facilitate PCI DSS audits end to end, coordinating audit readiness, evidence and documentation requests, control-owner engagement, interviews, walkthroughs, testing support, auditor inquiries, fieldwork, and remediation activities to support successful completion of the PCI DSS assessment.
• Serve as the primary coordination point between external auditors and internal Data and Control Owners, scheduling interviews, walkthroughs, onsite and remote fieldwork, and working sessions while ensuring auditors receive appropriate access, evidence, clarification, and support.
• Manage inquiries, clarification requests, and follow-ups from both auditors and internal stakeholders throughout the audit lifecycle, while ensuring the confidentiality and integrity of sensitive audit information.
• Review preliminary audit findings and reports, coordinate responses with appropriate Data and Control Owners, and track resulting action items through timely remediation and validation of closure.
• Provide weekly and monthly audit status reporting covering overall audit health, outstanding requests, issues, risks, and actions; conduct recurring status meetings and working sessions to drive resolution of open audit items.
• Drive continuous improvement and audit readiness through research and analysis, staff education, Data Owner training, and post-audit reviews that identify lessons learned, compliance gaps, required remediation, accountable owners, and improvement opportunities.

Experience Level:

5+ years.

Location:

Hyderabad / Bengaluru

Required skills:

• 3 years minimum experience in conducting IT audits, Risk assessments, information security compliance, or IT security operations.
• A minimum of 2 years’ experience leading ISO 27001, SOC, PCI audits
• Strong understanding of cybersecurity frameworks and standards (e.g., NIST, ISO 27001, CIS Controls).
• Excellent project management, organizational, and communication skills.

Desirable skills:

• Prior experience with Telecom sector.
• Relevant certifications such as ISO 27001 Lead Auditor/Implementer, CISSP, CISM, CRISC, or CISA

Understanding and Application of AI

• Familiarity with applying Artificial Intelligence (AI) or Machine Learning (ML) techniques in cybersecurity contexts
• Experience leveraging AI-enabled tools (such as Copilot for Security, Darktrace, CrowdStrike Charlotte AI, or custom LLM integrations) to enhance detection, response, automation workflows.
• Understanding of LLM safety, prompt engineering, or AI governance frameworks (e.g., NIST AI and RMF, EU AI Act readiness) is a plus.
• Exposure to data science fundamentals relevant to security (pattern recognition, supervised vs. unsupervised learning, model validation).
• Awareness of AI-driven risks (e.g., adversarial ML, data poisoning, model hallucination) and their mitigation within enterprise environments.

Additional information (if any):

Need to be flexible to provide coverage in US morning hours.

Weekly Hours:

40

Time Type:

Regular

Location:

Bengaluru, India, Hyderabad, India

AT&T is a fair chance employer and does not initiate a background check until an offer is made. to learn more or request an application.