: Hands-on experience in SOC 2 Type I and Type II implementation/readiness and delivery. Strong understanding of AICPA Trust Services Criteria (TSC).

Experience with control mapping, gap assessments, evidence collection and validation. Understanding of Type II observation periods, control operating effectiveness and exceptions.

Experience coordinating with external auditors/CPA firms. Ability to manage SOC 2 engagements from kickoff through audit closure.2. ISO 27001 Expertise Robust understanding of ISO/IEC 27001:2022 requirements.

Experience implementing and maintaining an Information Security Management System (ISMS). Conducting ISO 27001 gap assessments and readiness assessments. Understanding of Annex A controls and applicability assessment.

Experience with: Risk assessment and risk treatment Statement of Applicability (So A)Information security policies and procedures Internal audits Management reviews Corrective actions / NC management Continual improvement ISMS metrics and monitoring Experience supporting organizations through ISO 27001 certification audits. Understanding of Stage 1 and Stage 2 audit processes.3. Governance, Risk &

- Compliance (GRC)Strong understanding of GRC frameworks and principles. Ability to establish and maintain governance processes.

Experience with: Risk management Control frameworks Compliance assessments Regulatory requirements Policy governance Exception management Risk acceptance Corrective and preventive actions Compliance monitoring Ability to map controls across multiple frameworks such as SOC 2, ISO 27001, PCI DSS, GDPR, HIPAA, etc.4. Compliance &

- Audit Management Manage internal and external compliance assessments. Prepare organizations for certification and attestation audits. Develop audit plans, evidence trackers and compliance calendars. Review audit evidence for completeness and adequacy. Manage audit observations, non-conformities and corrective actions. Coordinate with auditors and stakeholders to resolve audit queries. Maintain appropriate audit trails and compliance documentation.5.

Risk Management





Conduct information security risk assessments. Identify, assess and prioritize organizational risks.

Develop Risk Treatment

Plans (RTPs). Maintain risk registers. Evaluate residual risk and risk acceptance. Support business owners in implementing appropriate risk mitigation measures.6. Policies &

- Documentation Candidate should be comfortable creating/reviewing: Information Security Policy ISMS documentation Risk Management Policy Access Control Policy Incident Management Policy Business Continuity/DR policies Vendor Risk Management Policy Change Management Policy Secure SDLC policies Data Protection/Privacy policies Business Continuity documentation Control procedures and work instructions7. Client &
- Stakeholder Management Conduct client discovery and kickoff meetings. Understand business processes, technology environments and compliance requirements. Act as the primary delivery contact for clients. Conduct regular status meetings. Track milestones, dependencies, risks and deliverables. Communicate compliance requirements clearly to technical and non-technical stakeholders. Manage escalations and ensure timely closure of deliverables.8.

Technical Security Understanding

Candidate should have a good working understanding of: AWS / Azure / GCPIAM, SSO and MFAVulnerability management Secure SDLCChange management Incident response Logging and monitoring Encryption Backup and DREndpoint security Network security Asset management Vendor/third-party security Data protection They don't need to be a penetration tester or security engineer, but should be able to understand technical controls and assess their compliance implications.

Key Skills Must Have: SOC 2 Type I/IIISO 27001:2022 ISMS implementation GRCRisk assessment & treatment Control assessment Audit management Evidence review Compliance management Policy/procedure development Client management Strong documentation and communication skills Good to Have: CISA / CISSP / CRISCISO 27001 Lead Auditor / Lead Implementer ISO 27701 PCI DSSHIPAAGDPRNIST CSF / NIST 800-53 CSA CCMExperience with GRC platforms such as Vanta, Drata, Secureframe, One Trust, etc.

📌 Sr. Consultant - Compliance (Delhi)
🏢 TAC Security
📍 Delhi