Senior Security Consultant

Key Responsibilities Provide consulting to implement and manage Information SecurityManagement Systems (ISMS) and apply IT Systems Continuity Management concepts to client environments. Collaborate with customers to understand their business goals and objectives, ensuring their expectations are exceeded by building and maintaining strong relationships. Utilize industry-standard securityframeworks and standards such as ISO 27001:2022 to enhance customer securitypostures. Independently manage information securityprojects, ensuring adherence to deadlines and delivery goals. Efficiently allocate and manage project resources, and communicating project status and progress to stakeholders. Lead projects to identify and assess securitycontrols, implementing enhancements based on key performance indicators (KPI) metrics for customer systems. Design and assist clients to implement information securitycontrols that meet industry standards for customer environments. Report on the effectiveness of securitycontrols to customer management and identify opportunities for improvement. Develop and document information securitypolicies, processes, standards, and procedures. Ensure effective communication of these policies and procedures across the customer's organization. Identify and interpret legal, regulatory, and statutory information securitycompliance requirements relevant to customer operations. Plan and execute internal audits and support during external certification audits for customers, developing corrective action plans for audit findings. Monitor customer compliance through manual reviews and automated Governance, Risk, and Compliance (GRC) tools. Define and assess the customer's risk appetite and tolerance levels. Perform threat modeling and vulnerability/gap analysis for customer environments. Conduct risk assessment exercises and workshops, designing and implementing Risk Treatment Plans (RTPs). Develop and monitor Key Risk Indicators (KRIs) for customers. Communicate risk assessments and mitigation plans to seniormanagement within customer organizations. Effectively communicate complex securityconcepts to both technical and non-technical customer audiences. Analyze complex securityinformation to identify root causes and develop well-reasoned recommendations based on analysis. Creating elaborate reports and presentations about Securityassessments/audits findings/observations Writing/ Documentation of organization level securitypolicies, processes and procedures in collaboration with multiple stakeholders Organizing and conducting ISMS workshops and securityawareness/training sessions effectively Stay updated on regional information securitystandards and regulations in GCC, India, Europe, and North America. Keep customers informed about the latest cybersecurity news and emerging threats. Deliverables and Outcomes Build and maintain strong customer relationships, ensuring their business goals and objectives are met and incorporated in the securityprogram. Successfully manage and deliver information securityprojects on time and within scope. Enable customers to comply with their regional IS regulations and keep customers informed of emerging cybersecurity threats. Identify, assess, and enhance securitycontrols to meet industry standard benchmarks. Develop, document, and communicate comprehensive Information Securityframework policies and procedures. Conduct compliance audits and continuously monitor adherence to legal and regulatory requirements. Define customer risk appetite, perform risk assessments, and implement Risk Treatment Plans. Present risk mitigation strategies to seniormanagement and stakeholders. Key Skills Customer relationship management and relationship building In-depth knowledge on ISO 27001:2022 standard clauses and ISO 27002 Annexure Control guidance Knowledge about ISO 31000 or similar and its application on enterprise level Organizing and conducting effective information securitycommittee/Management review meetings and presentations Understanding about information securityprinciples (CIA) and its application on information system security Application of data classification framework/concepts, Identity and Access Management Concepts, Secure Software Development Lifecycle concepts, network defense in depth concepts. Working knowledge about cloud securityconcepts and any cloud platforms like Azure, AWS and/or GCP Exposure on facilitating SecurityAssessments and assurance audits (internal & certification audits) Working alongside with SecurityOperations Centre functions/incident management activities #J-18808-Ljbffr Dheya