Role purpose The auditor assesses the client's ICT and network infrastructure against ISO/IEC 27001:2022. They turn technical VAPT results into ISO non-conformities that management can act on, and track them to closure.

Key responsibilities

1. Plan and conduct ISO/IEC 27001:2022 internal and compliance audits of the client's ICT infrastructure.
2. Review VAPT reports and map each finding to the relevant Annex A control and ISO clause.
3. Raise non-conformities (major/minor) and observations with explicit evidence and risk rating.
4. Audit network equipment — routers, switches, firewalls, load balancers, wireless controllers, VPN gateways — for secure configuration and hardening.
5. Review network architecture, segmentation, access control lists and firewall rule bases.
6. Assess logging, monitoring, patch management, backup and access management practices against ISO controls.
7. Prepare audit reports, gap analyses and Statement of Applicability (SoA) reviews for client management.
8. Agree corrective action plans with system owners and verify closure of non-conformities.
9. Maintain risk register and audit evidence; support external certification and surveillance audits.
10. Brief client stakeholders on compliance status and present findings in review meetings.

Mandatory qualifications & certifications
- B.E./B.Tech/MCA/M.Sc. in Computer Science, IT,



Electronics or equivalent.
- ISO/IEC 27001 Lead Auditor certificate (2013 or 2022 version, from an accredited body such as BSI, TÜV, Intertek or DNV) — non-negotiable.
- 5+ years in information security or IT audit, with at least 3 years conducting ISO 27001 audits.
- Hands-on experience reading VAPT reports and mapping findings to ISO 27001 controls.
- Working knowledge of enterprise network equipment and its secure configuration.
- Willing to work onsite in Delhi full time.

Technical skills

Area

What the candidate should know

ISO 27001:2022

Clauses 4–10, Annex A (93 controls), SoA, risk assessment, NC classification

VAPT interpretation

Nessus, Qualys, Burp Suite, Nmap outputs; CVSS scoring; false-positive triage

Network equipment

Cisco, Juniper, Fortinet, Palo Alto, Check Point, Sophos; config review and hardening (CIS benchmarks)

Network security

VLANs, segmentation, ACLs, firewall rule review, VPN, NAC, wireless security

Systems

Windows/Linux server hardening, Active Directory, patch and vulnerability management

Monitoring

SIEM, syslog, log retention and review practices

Indian compliance

CERT-In directions (2022), CERT-In audit guidelines, IT Act 2000, DPDP Act 2023 basics

Reporting

Audit reports, gap analyses, CAPA tracking in Excel/GRC tools

📌 ICT Security & Compliance Auditor (ISO/IEC 27001 Lead Auditor) (New Delhi)
🏢 INNOVADOR INFOTECH PRIVATE
📍 New Delhi