Minimum of 8 years of extensive experience in information protection and risk management and /or assurance, including minimum of 6 years of experience in information protection controls assessments, with demonstrated depth in ISO/IEC 27001 auditing and /or implementation and complex or judgment intensive reviews based on leading industry practices for internal audits and external / supplier audits.

Advanced and well-rounded expertise in information security and privacy, with the ability to interpret requirements and risks in complex, global, and non-standard scenarios.

Proven ability to function as a senior risk-based Quality Assessment (QA) reviewer of information controls audits, consistently exercising professional skepticism and independent judgment beyond procedural compliance, including the ability to:

Differentiate between technical noncompliance, actual risk exposure, significant control weaknesses, and documentation or evidentiary quality gaps Identify and assess misalignment between local control interpretations and global SOQM expectations Detect nuanced quality concerns such as unsupported assumptions, circular reasoning, weak analytic logic, or evidence that does not substantiate conclusions Strong understanding of information security and data protection contractual requirements of third party suppliers and their translation into risk‑based assessment outcomes.

Experience reviewing independent assurance reports for information security and privacy areas (e.g. ISO 27001, SOC 2),



including scope considerations, exceptions and residual risks.

Experience engaging with senior stakeholders and external third parties to communicate complex risk and assurance outcomes.

Highly developed written and verbal communication skills in English, with demonstrated strength in executive level reporting; excellent command of M365 tools, including Word, PowerPoint, Excel, Teams, and Copilot.

Ability to operate autonomously within a global delivery model, while effectively collaborating with diverse teams across geographies and time zones.

Prior supplier audit and/or third-party risk assessment experience strongly preferred; professional certifications such as ISO 27001:2022 Lead Auditor and/or ISO 42001 / AI Lead Auditor are a plus.

Prior experience with KPMG or another Big 4 organization preferred. Strong and practical familiarity with KPMG Global Information Security and Privacy Policies and frameworks, including Global Information Security Policies (GISP), Global Acceptable Use Policies (GAUP), and their application within a global System of Quality Management (SoQM) a plus.

Strong personal accountability combined with a collaborative leadership approach and well-developed stakeholder management skills, including comfort engaging at senior levels. Highly adaptive, capable of quickly assimilating current subject matter, with strong attention to detail and ability to maintain integrity and quality across multiple workstreams.

📌 Information Protection Assessments - Manager (Pune)
🏢 KPMG Delivery Network India 1
📍 Pune