Job Title: Senior Cloud & Cyber Security – Info Sec Specialist
About Us
“Capco, a Wipro company, is a global technology and management consulting firm. Awarded with Consultancy of the year in the British Bank Award and has been ranked Top 100 Best Companies for Women in India 2022 by Avtar & Seramount. With our presence across 32 cities across globe, we support 100+ clients across banking, financial and Energy sectors. We are recognized for our deep transformation execution and delivery.
WHY JOIN CAPCO?
You will work on engaging projects with the largest international and local banks, insurance companies, payment service providers and other key players in the industry. The projects that will transform the financial services industry.
MAKE AN IMPACT
Innovative thinking, delivery excellence and thought leadership to help our clients transform their business. Together with our clients and industry partners, we deliver disruptive work that is changing energy and financial services.
#BEYOURSELFATWORK
Capco has a tolerant, open culture that values diversity, inclusivity, and creativity.
CAREER ADVANCEMENT
With no forced hierarchy at Capco, everyone has the opportunity to grow as we grow, taking their career into their own hands.
DIVERSITY & INCLUSION
We believe that diversity of people and perspective gives us a competitive advantage.
Location - BANGALORE
Role Description
Required Qualifications
- Seven or more years of relevant experience in information security, cloud security, security architecture, security engineering, technology risk, control assessment, or security standards development. • Demonstrated experience developing, maintaining, implementing, or assessing STIGs, CIS Benchmarks, secure configuration baselines, hardening guides, or equivalent technical security standards. • Practical security knowledge across GCP, AWS, and Azure, with strong working experience in at least two of the three cloud platforms and the ability to research requirements for the third. • Strong understanding of cloud security concepts across identity and access management, networking, compute, containers, serverless services, data protection, encryption and key management, logging, monitoring, vulnerability management, and platform governance. • Working knowledge of Azure Policy, Wiz, AWS Service Control Policies, GCP Organization Policies, CSPM capabilities, and automated configuration or compliance assessment approaches. • Experience reviewing technical evidence and determining whether it satisfies documented control requirements and assessment procedures. • Experience supporting manual control validation, attestation, evidence collection, remediation tracking, exception handling, or control approval workflows where automated validation is unavailable. • Knowledge of NIST SP 800-53, CIS Controls and Benchmarks, ISO/IEC 27001, zero trust principles, and risk-based control design. • Ability to interpret cloud-provider documentation and convert complex technical content into concise, testable, and auditable requirements. • Strong technical writing, analysis, organization, and stakeholder-management skills. • Ability to work independently, manage multiple assigned deliverables, incorporate review feedback, and maintain accurate status reporting in an Agile delivery environment.
Preferred Qualifications
- Cloud or security certification such as CCSP, CISSP, AWS Certified Security - Specialty, Microsoft Certified: Azure Security Engineer Associate, or Google Professional Cloud Security Engineer. • Experience in standards and lifecycle governance, security policy, control engineering, cloud governance, or technical control testing. • Experience with infrastructure as code or policy as code using Terraform, CloudFormation, Bicep, ARM templates, or equivalent technologies. • Experience with regulated financial services or another highly regulated industry. • Experience supporting audit or regulatory examinations and producing audit-defensible evidence packages. • Familiarity with Jira, Confluence, SharePoint, or comparable tools used to manage requirements, evidence, reviews, approvals, and delivery status.
Expected Deliverables
- New or revised cloud STIGs and supporting control documentation that meet SLG quality and governance requirements. • Documented cleanup recommendations and completed remediation of assigned STIG content. • Accurate control mappings, assessment procedures, implementation guidance, and evidence requirements. • Complete evidence packages and validation summaries for controls without automated CaC coverage. • Documented review comments, issue dispositions, stakeholder decisions, approvals, exceptions, and open dependencies. • Regular delivery-status reporting, including completed work, work in progress, blockers, and risks requiring escalation.
Engagement Success Criteria
- Assigned STIG deliverables are technically accurate, internally consistent, testable, traceable, and completed in accordance with agreed priorities and review cycles. • Evidence packages clearly demonstrate whether the applicable requirement has been implemented and contain sufficient documentation to support review and audit activities. • Manual validation is performed consistently where CaC is unavailable, with conclusions linked to the requirement, assessment method, evidence reviewed, and accountable approver. • Issues and dependencies are identified early, documented clearly, and escalated through the designated SLG governance process. • Work products are maintained in the approved repositories and can be understood and reused by TD personnel after the engagement ends.
