Job description

Job Description

4) Key Result Areas
Key results expected from the job and the supporting actions for each key result area.
Key Result Areas	Supporting Actions
ISMS & Security Governance	Own and operate the Enterprise Information Security Governance & IT Risk Management program aligned to ISO 27001:2022, NIST CSF and DPDP Act. Develop, review and renew policies, standards and SOPs; maintain the policy renewal tracker and secure stakeholder/management approvals. Evaluate the organization’s security posture periodically and report to stakeholders.
Security Assessment & Technology Due Diligence	Conduct InfoSec assessments for new/existing projects and applications on a Secure-by-Design basis — review architecture, data flows and controls, and perform threat modelling. Assess controls, identify gaps, provide residual-risk assessments and track risk-treatment actions. Validate implementation (controls, VAPT, secure code review, logging/monitoring) and provide initial and final production sign-offs.
Application, API & Infrastructure Security	Govern application & API security — assess against InfoSec/AppSec checklists, oversee VA, PT and secure code reviews, and drive DevSecOps integration and application-layer attack mitigation. Maintain MBSS / Secure Configuration Documents (SCD); oversee configuration VA and compliance reviews. Maintain infrastructure security baselines, assess assets periodically, track and close observations with stakeholders.
Enterprise Vulnerability Management	Lead the Enterprise Vulnerability Management program across applications, infrastructure and configurations. Prioritise vulnerabilities by severity, business impact and exploitability; manage exceptions and escalate overdue items. Monitor remediation progress and ensure timely closure and reporting.
Cloud Security Governance	Implement and oversee cloud security best practices across AWS & Azure — IAM, encryption, network security and logging. Conduct cloud security, gap and compliance assessments for IaaS/PaaS/SaaS and remediate misconfigurations. Monitor and manage CNAPP tooling (CSPM, CIEM, CWPP) for continuous cloud posture management.
Security Operations, SIEM & Incident Management	Govern SIEM/SOC monitoring — asset onboarding, monthly reconciliation, use-case/detection enhancement and alert triage & closure. Oversee operational management of security tools (SIEM, EDR, DLP, WAF, IDS/IPS). Own incident management — detection, RCA, mitigation, monthly incident reporting and a learning matrix driving preventive controls.
Audit, Compliance & Regulatory Management	Manage internal, statutory, regulatory and certification audits — coordinate evidence, provide management responses/remediation plans and track observations to closure. Address queries from Compliance, Internal/External Audit and Regulators; implement policy/process updates for regulatory changes. Participate in CAB and assess the security implications of planned and emergency changes.
Business Continuity & Disaster Recovery	Maintain the annual DR drill calendar and secure committee approvals; govern DR drills for critical applications/infrastructure. Validate RTO/RPO achievement, close DR observations and maintain DR documentation for audit/regulatory purposes (BIA, BCRA, FRP, IT DR drills).
Third-Party Risk & Vendor Governance	Drive Vendor Risk Assessment (VRA) and TPRM — maintain vendor inventory & criticality and the annual review calendar. Ensure timely completion of vendor assessments, review risk ratings and track closure of identified risks.
Awareness, Resilience & Executive Reporting	Run monthly awareness campaigns, annual training and phishing simulations with targeted remediation; execute annual CCMP tabletop / IR simulations. Prepare and present ITSC, IT Strategy Committee, RMC and Board reporting — InfoSec metrics, risk dashboards, KPI/KRI, compliance and audit status, and incident summaries; track decisions and action closure.

Someone shared one job with you. ASAI keeps finding the rest.

Scored, not searched. Every role ranked against your actual profile.

Alerts as often as hourly. Reach new roles while the pile is still small.

Skill gaps, spelled out. See exactly which requirements you don't meet yet.

Verified jobs, only. Say no to ghost jobs. Your time deserves respect.

Someone shared one job with you. ASAI keeps finding the rest.

Scored, not searched. Every role ranked against your actual profile.

Alerts as often as hourly. Reach new roles while the pile is still small.

Skill gaps, spelled out. See exactly which requirements you don't meet yet.

Verified jobs, only. Say no to ghost jobs. Your time deserves respect.

Job description

Job Description

4) Key Result Areas
Key results expected from the job and the supporting actions for each key result area.
Key Result Areas	Supporting Actions
ISMS & Security Governance	Own and operate the Enterprise Information Security Governance & IT Risk Management program aligned to ISO 27001:2022, NIST CSF and DPDP Act. Develop, review and renew policies, standards and SOPs; maintain the policy renewal tracker and secure stakeholder/management approvals. Evaluate the organization’s security posture periodically and report to stakeholders.
Security Assessment & Technology Due Diligence	Conduct InfoSec assessments for new/existing projects and applications on a Secure-by-Design basis — review architecture, data flows and controls, and perform threat modelling. Assess controls, identify gaps, provide residual-risk assessments and track risk-treatment actions. Validate implementation (controls, VAPT, secure code review, logging/monitoring) and provide initial and final production sign-offs.
Application, API & Infrastructure Security	Govern application & API security — assess against InfoSec/AppSec checklists, oversee VA, PT and secure code reviews, and drive DevSecOps integration and application-layer attack mitigation. Maintain MBSS / Secure Configuration Documents (SCD); oversee configuration VA and compliance reviews. Maintain infrastructure security baselines, assess assets periodically, track and close observations with stakeholders.
Enterprise Vulnerability Management	Lead the Enterprise Vulnerability Management program across applications, infrastructure and configurations. Prioritise vulnerabilities by severity, business impact and exploitability; manage exceptions and escalate overdue items. Monitor remediation progress and ensure timely closure and reporting.
Cloud Security Governance	Implement and oversee cloud security best practices across AWS & Azure — IAM, encryption, network security and logging. Conduct cloud security, gap and compliance assessments for IaaS/PaaS/SaaS and remediate misconfigurations. Monitor and manage CNAPP tooling (CSPM, CIEM, CWPP) for continuous cloud posture management.
Security Operations, SIEM & Incident Management	Govern SIEM/SOC monitoring — asset onboarding, monthly reconciliation, use-case/detection enhancement and alert triage & closure. Oversee operational management of security tools (SIEM, EDR, DLP, WAF, IDS/IPS). Own incident management — detection, RCA, mitigation, monthly incident reporting and a learning matrix driving preventive controls.
Audit, Compliance & Regulatory Management	Manage internal, statutory, regulatory and certification audits — coordinate evidence, provide management responses/remediation plans and track observations to closure. Address queries from Compliance, Internal/External Audit and Regulators; implement policy/process updates for regulatory changes. Participate in CAB and assess the security implications of planned and emergency changes.
Business Continuity & Disaster Recovery	Maintain the annual DR drill calendar and secure committee approvals; govern DR drills for critical applications/infrastructure. Validate RTO/RPO achievement, close DR observations and maintain DR documentation for audit/regulatory purposes (BIA, BCRA, FRP, IT DR drills).
Third-Party Risk & Vendor Governance	Drive Vendor Risk Assessment (VRA) and TPRM — maintain vendor inventory & criticality and the annual review calendar. Ensure timely completion of vendor assessments, review risk ratings and track closure of identified risks.
Awareness, Resilience & Executive Reporting	Run monthly awareness campaigns, annual training and phishing simulations with targeted remediation; execute annual CCMP tabletop / IR simulations. Prepare and present ITSC, IT Strategy Committee, RMC and Board reporting — InfoSec metrics, risk dashboards, KPI/KRI, compliance and audit status, and incident summaries; track decisions and action closure.