Designation: Security Engineer
Department: Information Technology
Experience: 04 to 06 Years
Location: Corporate
Qualification: B.Tech/B.E. in Computer Science, Information Technology, Electronics, or related field. Relevant security certifications are preferred.

Role Purpose
The Security Engineer will be responsible for implementing, monitoring, and maintaining the organization's cybersecurity infrastructure to protect systems, networks, applications, and data from security threats. The role involves vulnerability management, incident response, security monitoring, and compliance activities.

Key Responsibilities

Security Governance & Policy Management

- Develop, review, and maintain information security policies, standards, procedures, and guidelines.
- Ensure security governance practices align with business objectives and regulatory requirements.
- Support policy exception management, approvals, and tracking.
- Maintain security governance documentation and evidence repositories.

Risk Management & Compliance

- Perform cybersecurity risk assessments and support risk remediation activities.
- Identify security gaps and recommend mitigation strategies.
- Support compliance activities related to industry regulations and standards.
- Maintain risk registers and security governance dashboards.

Regulatory & Framework Alignment

- Support compliance with security frameworks and regulations such as:
- ISO 27001
- NIST Cybersecurity Framework
- SOC
- HIPAA
- GDPR
- GxP / FDA requirements (21 CFR Part 11, Annex 11)
- Computer System Validation (CSV) security controls

Audit & Assessment Support

- Coordinate internal and external cybersecurity audits.
- Collect, validate, and maintain audit evidence.
- Support remediation tracking for audit findings.
- Work with stakeholders to ensure timely closure of compliance gaps.





Third-Party Risk Management

- Perform security assessments of vendors, suppliers, and technology partners.
- Review vendor security questionnaires and risk documentation.
- Support third-party risk reviews and governance processes.

Security Awareness & Training Management

- Develop and manage cybersecurity awareness programs for employees, contractors, and third-party users.
- Coordinate mandatory security training campaigns and track completion status.
- Support phishing simulation exercises and analyze user behavior trends.
- Maintain training records, evidence, and compliance reports for audit purposes.

Vulnerability Assessment & Penetration Testing (VAPT) Governance

- Coordinate periodic Vulnerability Assessment and Penetration Testing activities across applications, infrastructure, networks, and cloud environments.
- Define VAPT scope, objectives, timelines, and testing requirements with application owners and infrastructure teams.
- Review and validate VAPT reports.
- Track vulnerability remediation activities and ensure closure within defined SLAs.
- Perform risk acceptance reviews for vulnerabilities that cannot be remediated.
- Maintain vulnerability registers and remediation dashboards.

SOP Development & Governance

- Develop, review, update, and maintain Information Security Standard Operating Procedures (SOPs).
- Ensure SOPs align with organizational security policies, regulatory requirements, and industry standards.




- Manage SOP lifecycle including:
- Drafting
- Stakeholder review
- Approval workflow
- Version control
- Periodic review
- Retirement of obsolete documents
- Maintain security procedures and work instructions repository.
- Support change management activities related to security documentation.

Security Metrics & Reporting

- Develop security governance reports and dashboards.
- Track KPIs/KRIs related to cybersecurity posture.
- Prepare management-level presentations on security risks and compliance status.

Stakeholder Collaboration

- Collaborate with IT, cybersecurity, Quality, Regulatory Affairs, Privacy, and business teams.
- Support security awareness and governance initiatives.
- Communicate security risks and compliance requirements effectively.

Required Skills & Qualifications

- 45 years of experience in Cybersecurity Governance, Risk & Compliance (GRC), or Information Security.
- Experience in security policies, risk assessments, audits, and compliance activities.
- Knowledge of security frameworks such as ISO 27001.
- Experience working with security controls and risk management processes.
- Strong documentation and communication skills.
- Experience supporting regulated environments.

Technical Knowledge

- GRC platforms
- Security risk assessment methodologies
- Identity and Access Management (IAM) concepts
- Vulnerability management processes
- Cloud security governance concepts (AWS/Azure/GCP)
- Security audit and compliance tools

Key Competencies

- Robust analytical and problem-solving skills
- Ability to work with cross-functional global teams
- Attention to detail and compliance mindset
- Ability to manage multiple governance activities simultaneously

Strong written and verbal communication skills

📌 Security Engineer-Hyderabad
🏢 Sai Life Sciences
📍 Hyderabad