Senior InfoSec Engineer in India at Jobgether

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Senior InfoSec Engineer based in India.

As a Senior InfoSec Engineer, you will play a critical role in strengthening information security governance, risk management, and compliance across a complex international organization. You will focus on assessing and testing security controls, evaluating their design and operational effectiveness, and ensuring alignment with established security policies and industry standards. Working closely with Information Security teams, control owners, technical experts, and business stakeholders, you will identify potential risks, assess control gaps, and support effective remediation initiatives. You will also contribute to risk assessments, policy exception management, and continuous improvements across governance processes. Using established frameworks such as NIST and ISO 27001, you will help maintain a strong and consistent security posture while ensuring audit readiness. This is an opportunity to take ownership of meaningful security initiatives within a collaborative, global, and technology-driven environment.

• Perform security control assessments: Conduct comprehensive information security control assessments, evaluating both design effectiveness and operating effectiveness across established security controls.
• Develop and execute testing procedures: Create and implement structured control testing methodologies, define evidence requirements, evaluate control populations and samples, and document clear assessment conclusions.
• Review security documentation and evidence: Examine policies, standards, procedures, system-generated reports, screenshots, tickets, and other supporting documentation to determine whether security controls are properly designed and functioning as intended.
• Collaborate with control owners: Work closely with Information Security specialists, technical subject matter experts, and control owners to clarify control requirements, collect supporting evidence, validate exceptions, and communicate assessment findings.
• Support multi-entity assessments: Contribute to Multi-Brand Entity (MBE) control assessments by reviewing security control implementation and supporting evidence across applicable business entities.
• Manage policy exception processes: Support the Policy Exception Request (PER) lifecycle, including reviewing exception requests, coordinating with stakeholders, providing risk assessment inputs, monitoring progress, and ensuring appropriate closure.
• Conduct information security risk assessments: Identify and evaluate security risks by assessing inherent risk, likelihood, potential impact, residual risk, and relevant mitigating controls using established methodologies.
• Apply security frameworks and standards: Interpret and implement information security policies, standards, and control requirements, referencing frameworks such as NIST Cybersecurity Framework (CSF), ISO/IEC 27001, and ISO/IEC 27002.
• Maintain audit-ready documentation: Prepare and maintain accurate assessment workpapers, supporting evidence, control testing records, and documentation required for internal and external audit activities.
• Monitor remediation activities: Track identified control gaps, remediation actions, deadlines, and outstanding issues while supporting governance reporting and follow-up activities.
• Drive continuous improvement: Identify opportunities to improve GRC processes, data quality, reporting, workflow automation, and overall assessment efficiency.
• Support security governance initiatives: Collaborate with India-based and U.S.-based teams, providing clear, timely, and evidence-based updates to GRC leadership and Information Security stakeholders.

• Bachelor's degree in Computer Science, Information Security, Engineering, Risk Management, or a related discipline, or equivalent relevant professional experience.
• At least 7 years of professional experience in Information Security, with relevant expertise in Governance, Risk & Compliance (GRC), security controls, auditing, or assurance activities.
• Hands-on experience conducting information security control assessments and testing, including evaluating control design and operating effectiveness.
• Strong understanding of control testing methodologies, including evidence evaluation, sampling techniques, control populations, test procedures, exception identification, and assessment documentation.
• Practical knowledge of information security risk management principles, including risk identification, likelihood, impact, inherent risk, residual risk, mitigating controls, and risk treatment.
• Experience interpreting and applying information security policies, standards, procedures, and internal control requirements.
• Familiarity with industry frameworks and standards, particularly NIST Cybersecurity Framework (CSF), ISO/IEC 27001, and ISO/IEC 27002.
• Understanding of key Information Security domains, including Identity and Access Management (IAM), vulnerability management, network security, endpoint security, data protection, logging and monitoring, incident response, business continuity, and third-party security.
• Previous experience supporting policy exceptions, risk acceptance processes, issue management, remediation tracking, or similar governance activities is highly desirable.
• Experience using GRC platforms, workflow management solutions, ticketing systems, or evidence management tools. Familiarity with ServiceNow or similar platforms is an advantage.
• Strong analytical and critical-thinking skills, with the ability to identify security weaknesses, evaluate complex information, and develop practical recommendations.
• Excellent documentation and organizational skills, with exceptional attention to detail and the ability to maintain accurate, audit-ready records.
• Strong written and verbal communication skills, including the ability to work effectively with technical experts, control owners, business stakeholders, and international teams.
• Ability to manage multiple assessments and governance activities simultaneously, follow established methodologies, meet deadlines, and escalate issues appropriately.

Preferred certifications:

• Certified Information Systems Auditor (CISA).
• Certified in Risk and Information Systems Control (CRISC).
• Certified Information Systems Security Professional (CISSP).
• ISO/IEC 27001 certification.
• Other relevant Information Security, risk management, or GRC certifications.

• Fully remote working arrangement.
• Full-time employment within an established international organization.
• Opportunity to contribute to enterprise-wide information security and risk management initiatives.
• Exposure to global security governance practices and internationally recognized frameworks.
• Collaboration with experienced Information Security professionals and stakeholders across India and the United States.
• Opportunities to strengthen expertise in cybersecurity, compliance, risk assessment, and security assurance.
• Professional development opportunities through relevant training and industry certifications.
• Inclusive and collaborative working environment that values diversity, integrity, teamwork, and individual contributions.
• Opportunity to work with innovative technologies and contribute to the continuous improvement of enterprise security practices.