Description

You will lead the development, implementation, and maintenance of Information Security Management Systems (ISMS) and Privacy Information Management Systems (PIMS) across the organization.

Responsibilities

• Develop and maintain policies, procedures, and controls based on ISO/IEC 27001, ISO 27701, GDPR, CCPA, and PDPF standards.
• Perform enterprise-level risk assessments, vendor risk assessments, and business impact analyses (BIA) to define risk treatment plans.
• Manage internal, external, and client audits for frameworks including SOC 2 Type 2, PCI DSS, CMMC, and HITRUST.
• Investigate security incidents and vulnerabilities to identify root causes and implement corrective measures.
• Collaborate with IT, Security Operations, Legal, and HR to ensure compliance with contractual obligations and regulatory requirements.
• Conduct organizational training on information security, data protection, and security awareness.

Required Skills

• 5+ years of experience in information security, data protection, privacy laws, risk management, and incident management.
• Hands-on experience implementing and auditing ISO 27001, ISO 27701, GDPR, HIPAA, HITRUST, SOC 2 Type 2, and NIST.
• Proven experience managing client assignments regarding compliance requirements and conducting vendor risk assessments.
• Direct experience handling internal, external, and client-facing audits.
• Strong understanding of Business Continuity Planning (BCP) and Disaster Recovery (DR) frameworks.
• Ability to support Data Privacy Impact Assessments (DPIA) and privacy risk mitigation.
• Bachelor’s or Master’s degree in Information Security, IT, Computer Science, or a related field.

Preferred Skills

• ISO 27001 or ISO 27701 Lead Implementer/Auditor certifications.
• CISSP, CISA, CISM, CIPM, or Certified Internal Auditor credentials.
• Experience with ISO 42001, ISO 9001, CMMI, ISO 14001, or ISO 45001.

Key Skills

Education

Any Graduate