Minimum of 8 years of extensive experience in information protection and risk
management and /or assurance, including minimum of 6 years of experience in
information protection controls assessments, with demonstrated depth in
ISO/IEC 27001 auditing and /or implementation and complex or judgment
intensive reviews based on leading industry practices for internal audits and
external / supplier audits.
Advanced and well-rounded expertise in information security and privacy, with
the ability to interpret requirements and risks in complex, global, and
non-standard scenarios.
Proven ability to function as a senior risk-based Quality Assessment (QA)
reviewer of information controls audits, consistently exercising skilled
skepticism and independent judgment beyond procedural compliance, including
the ability to:
Differentiate between technical noncompliance, actual risk exposure,
significant control weaknesses, and documentation or evidentiary quality
gaps
Identify and assess misalignment between local control interpretations and
global SOQM expectations




Detect nuanced quality concerns such as unsupported assumptions, circular
reasoning, weak analytic logic, or evidence that does not substantiate
conclusions
Solid understanding of information security and data protection contractual
requirements of third party suppliers and their translation into risk‑based
assessment outcomes.
Experience reviewing independent assurance reports for information security
and privacy areas (e.g. ISO 27001, SOC 2), including scope considerations,
exceptions and residual risks.
Experience engaging with senior stakeholders and external third parties to
communicate complex risk and assurance outcomes.
Highly developed written and verbal communication skills in English, with
demonstrated strength in executive level reporting; excellent command of M365
tools, including Word, PowerPoint, Excel, Teams, and Copilot.
Ability to operate autonomously within a global de

📌 Information Protection Assessments Pune
🏢 KPMG Delivery Network India 1
📍 Pune