Opportunity brief
We are hiring our next Information Security Engineer.
Roles and Responsibilities:
- Own and strengthen Unstop's information security framework across websites, applications, APIs, cloud infrastructure, and internal technology systems.
- Conduct and coordinate Vulnerability Assessment and Penetration Testing (VAPT), identify security risks, and work with Engineering and DevOps teams to ensure timely remediation.
- Ensure compliance with applicable cybersecurity and data protection regulations, including the DPDP Act and Rules, IT Act, and CERT-In directions.
- Drive implementation and ongoing adherence to information security standards such as ISO 27001 and SOC 2, based on business requirements.
- Develop and maintain information security policies, access controls, data protection measures, and secure technology practices across the organisation.
- Lead internal and external security audits, maintain compliance documentation, and ensure closure of audit observations.
- Establish cybersecurity risk management, incident response, business continuity, and disaster recovery processes.
- Assess and manage security risks associated with third-party vendors, SaaS platforms, and technology integrations.
- Manage enterprise client security assessments, compliance questionnaires, and security-related due diligence requirements.
- Collaborate with Product, Engineering, IT, Legal, and business teams to integrate security and privacy requirements into technology and organisational processes.
- Monitor emerging cybersecurity threats, evaluate security tools and controls, and recommend improvements aligned with business needs.
- Define and report key security metrics, compliance status, and critical risks to leadership, ensuring clear accountability and timely resolution.
Qualifications:
- 3-5 years of proven work experience in related roles
- Certifications such as CISSP, CISM, CISA, CEH, or ISO 27001 Lead Implementer/Auditor preferred.
- Experience implementing or maintaining ISO 27001 or SOC 2 controls.
- Exposure to AWS, Azure, or GCP security.
- Experience in a high-traffic SaaS, marketplace, or B2B technology platform.
- Experience managing enterprise security assessments and customer compliance requirements.