About the role
Responsibilities:
- Review and update the information asset register in accordance with RBI, SEBI, IRDAI, UIDAI, IT Outsourcing, Data Localization, and ISO 27001:2013 requirements.
- Responsible for managing, tracking, updating, and monitoring all regulatory requirements.
- Review the classification levels of data, maintaining a risk register and tracking.
- Create and manage the KRI matrix and thresholds as per compliance, technology, policy, and process.
- Conduct data privacy or PII reviews within the department for PII protection for customers and employees.
- Conduct policy and process risk assessment of vendors while onboarding, evaluating, and monitoring and maintaining the same.
- Assist in IT security product and services risk assessment during evaluation and procurement.
- Track the annual review and changes to all policies and procedures, and draft and update/consolidate policy documents as needed.
- Assist in preparing decks/updates for committee meetings and other management review decks.
- Review the reports and alerts and be sure to close with service groups.
- Access Control Reviews for cloud, application, and infrastructure.
- Comprehensive risk assessment and control testing to be carried out annually and sustained.
- Assist in conducting the various simulations and campaigns for awareness and maintain measures to measure the effectiveness
- Assist in information security project implementation.
- Conduct access control, change management, and other process-level reviews.
- Timely escalation to the right stakeholder if any deliverable is at risk. Working closely with IT and other business functions of the organization for IS assessments and various risk review activities.
Requirements:
- ISMS implementation, policy, and procedure.
- Risk analysis and assessments.
- Conceptual knowledge of infrastructure technology and services, e. g., server infrastructure, development, firewalls, NAC, routers, etc.
- Proactive and able to handle independently with business functions.
- Understanding of business processes across all functions.
- 8+ years of experience in ISMS and ISO 27001 7 CISA, and ISO 27001 Certification.