Role purpose The auditor assesses the client's ICT and network infrastructure against ISO/IEC 27001:2022. They turn technical VAPT results into ISO non-conformities that management can act on, and track them to closure.

Key responsibilities

- Plan and conduct ISO/IEC 27001:2022 internal and compliance audits of the client's ICT infrastructure.
- Review VAPT reports and map each finding to the relevant Annex A control and ISO clause.
- Raise non-conformities (major/minor) and observations with transparent evidence and risk rating.
- Audit network equipment — routers, switches, firewalls, load balancers, wireless controllers, VPN gateways — for secure configuration and hardening.
- Review network architecture, segmentation, access control lists and firewall rule bases.
- Assess logging, monitoring, patch management, backup and access management practices against ISO controls.
- Prepare audit reports, gap analyses and Statement of Applicability (SoA) reviews for client management.
- Agree corrective action plans with system owners and verify closure of non-conformities.
- Maintain risk register and audit evidence; support external certification and surveillance audits.
- Brief client stakeholders on compliance status and present findings in review meetings.

Mandatory qualifications & certifications
- B.E./B.Tech/MCA/M.Sc. in Computer Science, IT, Electronics or equivalent.




- ISO/IEC 27001 Lead Auditor certificate (2013 or 2022 version, from an accredited body such as BSI, TÜV, Intertek or DNV) — non-negotiable.
- 5+ years in information security or IT audit, with at least 3 years conducting ISO 27001 audits.
- Hands-on experience reading VAPT reports and mapping findings to ISO 27001 controls.
- Working knowledge of enterprise network equipment and its secure configuration.
- Willing to work onsite in Delhi full time.

Technical skills

Area

What the candidate should know

ISO 27001:2022

Clauses 4–10, Annex A (93 controls), SoA, risk assessment, NC classification

VAPT interpretation

Nessus, Qualys, Burp Suite, Nmap outputs; CVSS scoring; false-positive triage

Network equipment

Cisco, Juniper, Fortinet, Palo Alto, Check Point, Sophos; config review and hardening (CIS benchmarks)

Network security

VLANs, segmentation, ACLs, firewall rule review, VPN, NAC, wireless security

Systems

Windows/Linux server hardening, Active Directory, patch and vulnerability management

Monitoring

SIEM, syslog, log retention and review practices

Indian compliance

CERT-In directions (2022), CERT-In audit guidelines, IT Act 2000, DPDP Act 2023 basics

Reporting

Audit reports, gap analyses, CAPA tracking in Excel/GRC tools

📌 ICT Security & Compliance Auditor (ISO/IEC 27001 Lead Auditor) (New Delhi)
🏢 INNOVADOR INFOTECH PRIVATE
📍 New Delhi