Lead - Information Security & Compliance Engineer

Job Description

Role & responsibilities Implement cybersecurity best practices across networks, applications, and cloud environments. Lead and maintain ISO/IEC 27001 standards, ensuring compliance with NIST, CIS Controls, and industry regulations. Conducting risk assessments, gap analyses, and defining security controls, policies, and procedures. Plan and conduct internal ISO 27001 audits, identify non-conformities, and recommend corrective actions. Assist in external audits and manage risk mitigation efforts to enhance security posture. Updated knowledge on cybersecurity threats and frameworks (NIST, CIS, GDPR). Perform vulnerability assessments, conduct penetration tests, and establish log analysis and threat detection capability. Maintain technical documentation (policies, risk registers, and audit reports) and develop security training materials. Integrate security into the development lifecycle. Conduct code reviews, threat modeling, and secure software assessments. Work closely with Western clients, ensuring clear communication on security requirements. Provide security advisory and consultation to clients and stakeholders. Translate complex cybersecurity concepts into business-friendly language Conduct employee training sessions on information security policies, procedures, and best practices. Promote a culture of security awareness and ensure employees understand their roles in maintaining compliance. Foster a collaborative and security-conscious culture within the team. Recruit, train, and retain top cybersecurity talent. Drive initiatives for continuous improvement and innovation in security practices. Manage the internal and external client relationships Preferred candidate profile Threat detection, Incident response, and Risk management Knowledge of SIEM tools like Wazuh/ Splunk/ SentinalOne/ AlienVault OSSIM (Now known as AT&T Cyber Security) Implementation of ISO 27001 Knowledge of NIST, CIS, GDPR, SOC 2, PCI-DSS frameworks. AWS, Azure, GCP, IDS/IPS, vulnerability scanners, GRC tools Problem-solving, Analytical, and decision-making. Documentation capabilities Team management, client handling, and cross-functional collaboration. Perks and benefits