Role & responsibilities

We are seeking a proactive and well-rounded Information Security professional with 4-6 years of experience across multiple security domains. This role will support the implementation, governance, and continuous improvement of Information Security controls across VFS Global's applications, infrastructure, cloud environments, third-party ecosystem, and business operations.

The ideal candidate should have hands-on experience across security operations, risk management, compliance, vulnerability management, cloud security, and identity & access management, and be comfortable working with internal stakeholders, technology partners, and managed security service providers.

Key Responsibilities

Security Operations & Incident Management

- Coordinate investigation and remediation of security incidents and alerts raised by MSSP/SOC teams.
- Support threat detection, incident response, root cause analysis, and closure activities.
- Track remediation of security findings and ensure SLA compliance.
- Review security monitoring reports and support continuous improvement initiatives.

Governance, Risk & Compliance

- Support ISO 27001, ISO 27017, ISO 27018, PIMS, SOC 2, and client/government security compliance activities.
- Participate in internal audits, certification audits, risk assessments, and control reviews.
- Maintain security policies, standards, procedures, and risk registers.
- Coordinate remediation of audit findings and compliance gaps.

Identity & Access Management

- Conduct periodic access reviews and privileged access validations.
- Support IAM governance activities including joiner, mover, leaver reviews.
- Assess user access risks and recommend improvements.

Vulnerability & Security Assurance

- Manage vulnerability assessment and remediation tracking activities.
- Review VAPT, SAST, DAST, and security assessment reports.
- Coordinate with technology teams to ensure timely closure of findings.




- Support secure configuration reviews and security hardening initiatives.

Cloud & Infrastructure Security

- Support security assessments of cloud platforms and hosted services.
- Review cloud security configurations and security posture reports.
- Participate in security architecture and design reviews.
- Assist in implementation of security controls across infrastructure and cloud environments.

Vendor & Third-Party Security

- Conduct third-party security assessments and vendor due diligence.
- Review supplier compliance with security requirements.
- Track remediation of identified third-party risks.
- Support vendor onboarding and periodic security reviews.

Security Awareness & Continuous Improvement

- Drive security awareness initiatives and phishing simulation programs.
- Support enhancement of security processes, automation opportunities, and reporting capabilities.
- Prepare security dashboards, metrics, and management reports.

Required Skills & Experience

- 4-6 years of Information Security experience.
- Valuable understanding of:
- Security Operations (SOC/SIEM)
- Vulnerability Management
- Identity & Access Management
- Cloud Security
- Risk Management
- ISO 27001 and Security Governance
- Incident Response
- Third-Party Risk Management

- Experience interacting with business, technology, and vendor teams.
- Ability to manage multiple security initiatives simultaneously.
- Strong analytical, communication, and stakeholder management skills.

Preferred

- Hands-on exposure to Cyber Security technologies.
- Understanding of Application Security findings (SAST/DAST/SCA).
- Familiarity with NIST CSF, CIS Controls, OWASP, and privacy regulations.
- Experience working with MSSP/SOC providers.

Qualifications

- Bachelor's degree in Information Technology, Computer Science, Cyber Security, or elated field.
- Preferred certifications:
- ISO 27001 LA/LI
- CEH
- Security+
- SC-200
- AZ-500
- CC / CISSP (Associate level acceptable)

📌 Information Security Manager (Mumbai)
🏢 VFS Global
📍 Mumbai