About the role
Governance, risk and compliance
• Maintaining Infosec Assets and Vendor Inventory along with Escalation Matrix
• Creation of policy/procedure/sop/guideline/checklist
• Review and modification of document as per IRDAI cyber security guideline/best practices.
• Perform gap assessment of process written in document vs followed and submit report and followed on actionable till closure.
• Half yearly Process reviews but not limited to
· o Patch Management
· o Antivirus/APT/EDR solution management
· o Change Management
· o Incident Management
· o Backup and Restoration Management
· o Application Security Management
· o Access management review
· o Email Management
· o Asset Management
• Conduct pre-audit before actual audit from internal auditor and ensure no major observations are raised. (Guidelines should be ISO 27001,ISO 22301,ISO 27701-Data Privacy ,NIST, CIS and Cybersecurity. But Not Limited to same).
• Conduct pre-audit before external audit conducted as per IRDAI’s cyber security and ISNP guidelines.
• Managing end to end new Third Party on boarding process and decommission of third-party process.
• Performing Vendor Audits
• Prepare and sent and review Third Party Monthly reports.
• Prepare and send monthly information security & Cyber security awareness mailers specific to BFSI
• Prepare and Conduct information & Cyber security awareness session as per requirement to end users
• Preparing and Updating Risk Assessment Procedure
• Preparing, Maintaining, Reviewing and updating Risk Assessment.
• Preparing, Maintaining, Reviewing and updating Information Asset and Application criticality
• Performing Application Assessment.
• Preparation of risk acceptance form and maintaining of tracker for the same
• Review half yearly sop documents/tracker and process of Infosec team,
• Conduct review with below mentioned frequencies but not limited too
· o Half yearly all application user access reconciliation and recertification and other cross checks of controls as per audit scope
· o Quarterly recertification of privileged access groups Domain Admins, L1 Admins and Enterprise admins
· o Half yearly recertification local admin accounts on servers/endpoints
· o Monthly patch compliance checking on minimum 5% endpoints on
· o network and on off network systems
o Quarterly patch compliance checking on minimum 5% endpoints on network and on off network systems
o Half yearly NTP review
o Quarterly review of admin user accounts of all Infra and Infosec solutions
o Half yearly review of Physical and environmental security
o Half yearly BCG and Disciplinary action reviews
o Half yearly Assess management process review
o Monthly call recording reviews
o Quarterly review of restricted physical access at DC and DR
o Quarterly review of Backup tape register and back tape movement and DC gate pass
o Bi-monthly review of replication from Primary DC to DR.
o Monitor and coordinate BCP Drill
• Prepare Information Security, Data Privacy and Cyber security Measurement Metrics
• Preparation of Infosec and Cyber security dashboard
Assist in Infosec Audits and coordination to get evidences
Desired Profile:
- Education: B-Tech / BE / BCA / MCA / MBA (IT/Systems)
- Goal-oriented individual with 3-5 years of experience and a pleasant personality with a persistence that knows no restrictions
- Ability to display project management skills and execute tasks within strict deadlines
- Excellent written and verbal communication skills
Skill Set: -
- IT Governance, Information Security, IRDAI, Compliance, Application control testing
- Certification: ISO-27001
- Ability to work with multiple teams and maintain seamless flow of deliverables