Senior InfoSec Engineer

Accountabilities:

Perform security control assessments: Conduct comprehensive information security control assessments, evaluating both design effectiveness and operating effectiveness across established security controls.
Develop and execute testing procedures: Create and implement structured control testing methodologies, define evidence requirements, evaluate control populations and samples, and document clear assessment conclusions.
Review security documentation and evidence: Examine policies, standards, procedures, system-generated reports, screenshots, tickets, and other supporting documentation to determine whether security controls are properly designed and functioning as intended.
Collaborate with control owners: Work closely with Information Security specialists, technical subject matter experts, and control owners to clarify control requirements, collect supporting evidence, validate exceptions, and communicate assessment findings.
Support multi-entity assessments: Contribute to Multi-Brand Entity (MBE) control assessments by reviewing security control implementation and supporting evidence across applicable business entities.
Manage policy exception processes: Support the Policy Exception Request (PER) lifecycle, including reviewing exception requests, coordinating with stakeholders, providing risk assessment inputs, monitoring progress, and ensuring appropriate closure.
Conduct information security risk assessments: Identify and evaluate security risks by assessing inherent risk, likelihood, potential impact, residual risk, and relevant mitigating controls using established methodologies.
Apply security frameworks and standards: Interpret and implement information security policies, standards, and control requirements, referencing frameworks such as NIST Cybersecurity Framework (CSF), ISO/IEC 27001, and ISO/IEC 27002.
Maintain audit-ready documentation: Prepare and maintain accurate assessment workpapers, supporting evidence, control testing records, and documentation required for internal and external audit activities.
Monitor remediation activities: Track identified control gaps, remediation actions, deadlines, and outstanding issues while supporting governance reporting and follow-up activities.
Drive continuous improvement: Identify opportunities to improve GRC processes, data quality, reporting, workflow automation, and overall assessment efficiency.
Support security governance initiatives: Collaborate with India-based and U.S.-based teams, providing clear, timely, and evidence-based updates to GRC leadership and Information Security stakeholders.
Requirements:
Bachelor's degree in Computer Science, Information Security, Engineering, Risk Management, or a related discipline, or equivalent relevant professional experience.
At least 7 years of professional experience in Information Security, with relevant expertise in Governance, Risk & Compliance (GRC), security controls, auditing, or assurance activities.
Hands-on experience conducting information security control assessments and testing, including evaluating control design and operating effectiveness.
Strong understanding of control testing methodologies, including evidence evaluation, sampling techniques, control populations, test procedures, exception identification, and assessment documentation.
Practical knowledge of information security risk management principles, including risk identification, likelihood, impact, inherent risk, residual risk, mitigating controls, and risk treatment.
Experience interpreting and applying information security policies, standards, procedures, and internal control requirements.
Familiarity with industry frameworks and standards, particularly NIST Cybersecurity Framework (CSF), ISO/IEC 27001, and ISO/IEC 27002.
Understanding of key Information Security domains, including Identity and Access Management (IAM), vulnerability management, network security, endpoint security, data protection, logging and monitoring, incident response, business continuity, and third-party security.
Previous experience supporting policy exceptions, risk acceptance processes, issue management, remediation tracking, or similar governance activities is highly desirable.
Experience using GRC platforms, workflow management solutions, ticketing systems, or evidence management tools. Familiarity with ServiceNow or similar platforms is an advantage.
Strong analytical and critical-thinking skills, with the ability to identify security weaknesses, evaluate complex information, and develop practical recommendations.
Excellent documentation and organizational skills, with exceptional attention to detail and the ability to maintain accurate, audit-ready records.
Strong written and verbal communication skills, including the ability to work effectively with technical experts, control owners, business stakeholders, and international teams.
Ability to manage multiple assessments and governance activities simultaneously, follow established methodologies, meet deadlines, and escalate issues appropriately.
Preferred certifications:
Certified Information Systems Auditor (CISA).
Certified in Risk and Information Systems Control (CRISC).
Certified Information Systems Security Professional (CISSP).
ISO/IEC 27001 certification.
Other relevant Information Security, risk management, or GRC certifications.
Benefits:
Fully remote working arrangement.
Full-time employment within an established international organization.
Opportunity to contribute to enterprise-wide information security and risk management initiatives.
Exposure to global security governance practices and internationally recognized frameworks.
Collaboration with experienced Information Security professionals and stakeholders across India and the United States.
Opportunities to strengthen expertise in cybersecurity, compliance, risk assessment, and security assurance.
Professional development opportunities through relevant training and industry certifications.
Inclusive and collaborative working environment that values diversity, integrity, teamwork, and individual contributions.
Opportunity to work with innovative technologies and contribute to the continuous improvement of enterprise security practices.