Key Responsibilities:

Vulnerability Management & VAPT:

- Manage end-to-end VAPT and vulnerability management activities.

- Coordinate scanning, validation, risk prioritisation, remediation, and closure.

- Support penetration testing and maintain audit evidence.

IAM & PAM:

- Implement and manage IAM/PAM controls including RBAC, MFA, least privilege, and access reviews.

- Monitor privileged access and support secure onboarding/offboarding.

Secure SDLC & DevSecOps:

- Implement SSDLC/DevSecOps security controls across the development lifecycle.

- Integrate SAST, DAST, and SCA into CI/CD pipelines.

- Support remediation of application and API vulnerabilities.

Information Security Governance & Compliance:

- Implement controls aligned with ISO 27001/27002, NIST, PCI-DSS, and organisational security standards.

- Support audits, compliance assessments, risk management, documentation, and control evidence.

Endpoint & Cloud Security:

- Manage EDR/XDR, endpoint hardening, encryption, patching, and security configurations.

- Support security controls across enterprise infrastructure and cloud environments.

Security Monitoring & Incident Response:

- Support SOC/SIEM, security monitoring, threat detection, and alert tuning.

- Participate in incident response, containment, recovery, drills, and post-incident reviews.

AI & Emerging Technology Security:

- Support AI governance, AI/ML risk assessments, access controls, logging, monitoring, and sensitive-data protection.

- Conduct vendor security assessments and due diligence.

- Track third-party security risks, remediation, and compliance.

Data Protection:

- Implement PII/HSPII protection controls covering encryption, access, logging, monitoring, and retention.

- Support privacy and data-security assessments.

Security Awareness:

- Support security awareness and phishing simulation programs.

- Track training effectiveness and security awareness metrics.