Information Security Analyst / Specialist

We are looking for a detail-oriented Information Security Analyst/Specialist to join our InfoSec team. The ideal candidate will ensure compliance with industry standards, strengthen security operations, manage risks, and collaborate across teams to safeguard our systems and data.

Responsibilities :

Information Security Governance & Compliance :

- Manage compliance with ISO 27001 : 2022 and SOC 2 Type II frameworks.

- Support ITGC audits in collaboration with Finance.

- Conduct internal audits, gap assessments, and evidence collection for certification and surveillance audits.

- Review and update ISMS policies, procedures, and controls regularly.

- Support customer and prospect audits by providing responses, clarifications, and documentation.

Risk & Threat Management :

- Perform application, infrastructure, and vendor risk assessments.

- Conduct third-party/vendor security assessments and track remediation.

- Monitor and ensure closure of audit findings, vulnerabilities, and identified security gaps.

Security Operations & Monitoring :

- Review AWS logs, IAM, RBAC, firewall rules, and other security configurations.

- Conduct monthly/quarterly user access reviews across systems (SSH, RBAC, DB, SaaS).

- Track patch management, antivirus, and endpoint protection compliance.

- Manage SIEM and SAST tools for continuous monitoring.

Vulnerability & Incident Management :

- Coordinate periodic VAPT (Infra, Web, Mobile) with external agencies and internal teams.

- Support remediation, validation, and closure of vulnerabilities.

- Assist in incident response, root cause analysis, and corrective actions.

Skills & Qualifications :

- Strong understanding of ISO 27001 : 2022, SOC 2 Type II, ITGC audits, ISMS policies.

- 2 to 5 Years of relevant experience.

- Experience in VAPT coordination, remediation, and vulnerability management.

- Knowledge of AWS security configurations, IAM, RBAC, firewall rules, and cloud security practices.

- Hands-on experience with SIEM, SAST (SonarQube), endpoint protection, and patch management tools.

- Familiarity with Disaster Recovery, BCP, and backup strategies.

Analytical & Risk Management Skills :

- Proficiency in conducting risk assessments and managing risk treatment plans

- Experience with vendor/third-party assessments and compliance documentation.

- Strong troubleshooting and root cause analysis abilities.

Preferred Qualifications :

- Bachelors degree in Computer Science, Information Security, or related field.

- Industry certifications such as ISO 27001 Lead Auditor/Implementer, CISA, CISSP, CISM, CEH, or AWS Security Specialty (preferred but not mandatory).