InfoSec Engineer (Compliance Engineer)

• Lead ISO/IEC 27001:2022 compliance initiatives, including implementation, internal audits, surveillance, and recertification audits.
• Prepare and maintain documentation for audits, including evidence collection and audit logs.
• Conduct or support internal VAPT exercises; work with external vendors for third-party assessments and ensure closure of findings.
• Evaluate and ensure security compliance in cloud environments (AWS), including configuration reviews and adherence to cloud security best practices.
• Perform security risk assessments, gap analyses, and impact assessments across systems, processes, and vendors.
• Collaborate cross-functionally with Engineering, IT, Legal, and HR to ensure compliance across business units.
• Develop and maintain security policies, procedures, standards, and guidelines aligned with ISO 27001 and other applicable frameworks.
• Monitor compliance with regulatory requirements (eg, GDPR, SOC 2, NIST, HIPAA) and internal policies.
• Assist in developing security awareness training and conducting compliance onboarding for new employees.
• Stay updated on emerging threats, vulnerabilities, and evolving regulatory requirements.

• Minimum 3+ years of experience in a security compliance, security engineering, or audit-focused role.
• Strong experience with ISO/IEC 27001:2022 implementation, audits, and certification processes.
• Practical knowledge of VAPT tools and methodologies, including reporting and remediation tracking.
• Solid understanding of cloud security principles (preferably with hands-on experience in AWS).
• Familiarity with security controls, risk management, and audit frameworks (eg, SOC 2, NIST, GDPR).
• Excellent documentation and communication skills, especially for audit readiness and stakeholder reporting.
• Ability to manage multiple security and compliance initiatives simultaneously.

• Certifications such as ISO 27001 Lead Auditor/Implementer, CEH, or CCSK.
• Exposure to secure software development lifecycle (SDLC) and DevSecOps practices.
• Familiarity with identity and access management (IAM), data loss prevention (DLP), and endpoint security tools.

Education & Experience:

• Bachelors degree in Computer Science, Information Security, Cybersecurity, or a related field.
• 3+ years of experience in a security compliance, security engineering, or audit-focused role