Information Security Manager
- Crisil
- 5 - 10 years
- Mumbai
- 2 months ago
- Email to a friend
- Report this job
Job Description
Role Summary:
The Senior Lead IS GRC will be responsible for strengthening Crisils Information Security Governance, Risk, and Compliance (GRC) function through execution of internal audits, risk assessments, compliance reviews, and control effectiveness testing. The role includes managing ISO 27001 certification activities, SOC 2 readiness, NIST CSF implementation, incident response support, employee awareness programs, and automation of IS GRC processes. The candidate will also support risk consulting activities by reviewing business requests for new initiatives or changes and providing risk-based approvals and recommendations.
Key Responsibilities:
1. Internal Audit & Control Testing
Conduct internal audits aligned with ISO 27001:2022 and organizational policies.
Perform design and operating effectiveness testing of information security and IT controls.
Maintain audit workpapers, reports, and action trackers in alignment with defined processes.
2. SOC 2 Readiness & Audit Management
Manage SOC 2 readiness activities in line with Trust Services Criteria.
Coordinate with external auditors and internal stakeholders for successful audit execution.
Track compliance and control effectiveness related to SOC 2 requirements.
3. NIST Cybersecurity Framework (NIST CSF)
Support implementation and monitoring of NIST CSF controls across relevant domains.
Conduct gap assessments, document control maturity, and recommend improvements.
4. ISO 27001 Implementation & Maintenance
Lead efforts to sustain ISO 27001 certification, including SOA and Risk Treatment Plan updates.
Prepare for and manage certification and surveillance audits.
Support closure of audit findings and continuous improvement activities.
5. Risk Management & Consulting
Perform risk assessments for IT and cybersecurity initiatives and maintain risk registers.
Evaluate risk impact of business or IT consulting requests and provide formal recommendations or approvals.
Monitor risk mitigation activities and report risk posture to relevant stakeholders.
6. GRC Process Management & Automation
Drive automation initiatives for control testing, evidence collection, audit tracking, and compliance dashboards.
Support maintenance and operation of GRC tools and platforms, ensuring data accuracy and completeness.
7. Incident Response & Reporting
Assist in the development and maintenance of the organizations incident response plan.
Support investigations of security incidents and ensure timely escalation and resolution.
8. Training & Awareness
Conduct periodic cybersecurity awareness training for employees and contractors.
Reinforce understanding of security policies, roles, and regulatory responsibilities across the organization.
Required Qualifications & Experience:
Bachelors degree in Information Technology, Computer Science, or related field.
Minimum 6 years of experience in information security audits, risk assessments, and compliance.
Strong understanding of ISO 27001, SOC 2, NIST CSF, ITGC, and risk-based consulting.
Familiarity with regulatory requirements such as SEBI CSCRF.
Experience in conducting internal audits, risk reviews, and process automation.
Preferred certifications: ISO 27001 Lead Auditor, CISA, CRISC, or equivalent.
Key Competencies:
Strong analytical and documentation skills
Clear and effective communication with technical and non-technical stakeholders
Ability to independently manage audits, assessments, and compliance initiatives
Proactive and structured approach to risk evaluation and issue resolution
Exposure to GRC platforms and automation tools is preferred
Job Classification
Industry: Financial ServicesFunctional Area / Department: IT & Information SecurityRole Category: IT SecurityRole: Manager Information SecurityEmployement Type: Full timeContact Details:
Company: CrisilLocation(s): Mumbai
Keyskills: risk assessments risk management crisc iso analytical soc documentation information security audit nist csf internal audit nist framework automation tools itgc compliance control testing grc risk cisa risk reviews process automation communication skills
Similar positions
Crisil
CRISIL CRISIL is a an agile and innovative, global analytics company driven by its mission of making markets function better. We are India's foremost provider of ratings, data, research, analytics and solutions. A strong track record of growth, culture of innovation and global footprint sets us ...
Job Listings
We are in open beta version of website, please let us know if any issues, at: info(at)indigojobs.in