Company: Acadian Technologies Pvt. Ltd.

Product: VSPAGY – Personalized & Interactive Video Communication Platform

Department: Information Security, IT Governance & Compliance

Experience: 3–7 Years

Employment Type: Full-Time

Location: Office-Based

Job Summary

We are looking for a proactive and detail-oriented Information Security & IT Compliance professional to manage security audits, IT compliance, change management, information security policies, and client compliance requirements.

The candidate will be responsible for coordinating with banking clients, external security auditors, CERT-In empanelled audit firms, and internal technical teams to ensure that security assessments, audit observations, and compliance requirements are handled efficiently and within defined timelines.

The role requires a combination of information security knowledge, audit coordination, documentation, risk assessment, and the ability to work with technical teams to achieve audit closure.

Key Responsibilities

1. Security Audits & Compliance Management

- Coordinate and manage periodic information security audits and IT audits required by banking and enterprise clients.
- Liaise with CERT-In empanelled auditors and other external security assessment agencies.
- Coordinate Web Application VAPT, API VAPT, source code reviews, SAST, DAST, infrastructure security assessments, and server configuration audits.
- Understand audit observations, coordinate with technical teams for remediation, and track findings until closure.
- Maintain audit reports, remediation evidence, closure reports, and compliance documentation.
- Prepare responses to security questionnaires, IT audit observations, and compliance requirements received from banks.
- Coordinate with clients and auditors during audit discussions, evidence reviews, and closure meetings.

2. Information Security Policies & Documentation

- Develop, implement, review, and maintain information security policies, procedures, standards, and guidelines.
- Prepare and maintain policies and documents covering:
- Information Security Policy
- Access Control and User Access Management
- Password and Authentication Policy
- Change Management Policy
- Vulnerability and Patch Management Policy
- Incident Response and Management Policy
- Backup, Recovery, and Disaster Recovery Policy
- Business Continuity and Disaster Recovery (BCP/DR)
- Asset Management and Acceptable Use Policy
- Data Classification, Retention, and Disposal Policy
- Vendor and Third-Party Risk Management Policy
- Logging, Monitoring, and Audit Trail Policy
- Maintain standard operating procedures (SOPs), process documents, registers, and audit-ready evidence.
- Review policies periodically and update them based on applicable regulatory, contractual, and customer requirements.

3. IT Change Management

- Manage the change management process for application, database, infrastructure, and security-related changes.
- Ensure changes are supported by change requests, impact assessments,



risk assessments, approvals, testing evidence, implementation plans, and rollback plans.
- Maintain a change management register and ensure proper documentation of production releases and configuration changes.
- Coordinate with development, DevOps, infrastructure, and operations teams to collect required evidence.
- Ensure changes follow defined approval and release management procedures.
- Track emergency changes, post-implementation reviews, and exceptions.

4. Banking Client Compliance

- Review and respond to IT security questionnaires, vendor risk assessments, and compliance checklists received from banks.
- Coordinate with client IT, information security, risk, and audit teams.
- Prepare technical and management responses for security observations, audit findings, and compliance requirements.
- Maintain evidence for security controls, including access reviews, vulnerability remediation, backup verification, logging, encryption, incident management, and disaster recovery testing.
- Support compliance requirements arising from applicable RBI directions, CERT-In requirements, contractual obligations, and relevant security standards.
- Maintain records of compliance status, pending observations, action owners, and target closure dates.

5. Vendor & Third-Party Management

- Coordinate with external audit firms, CERT-In empanelled auditors, penetration testing vendors, and security consultants.
- Schedule assessments, share approved scope and required documents, facilitate access to the appropriate technical teams, and track assessment progress.
- Review audit deliverables for completeness and coordinate clarification of findings with the auditor.
- Track vendor deliverables, remediation retesting, final reports, and closure certificates or letters where applicable.
- Maintain vendor assessment records, engagement documents, reports, and compliance evidence.
- Support third-party risk assessments and periodic vendor security reviews.

6. Risk Management & Security Governance

- Maintain risk registers, audit observation trackers, corrective action plans, and compliance dashboards.
- Assist in vulnerability management, risk assessment, security incident documentation, and corrective and preventive action (CAPA) tracking.
- Coordinate periodic access reviews, asset reviews, backup checks, security configuration reviews, and disaster recovery drills.
- Identify gaps in existing processes and recommend improvements to strengthen security governance.
- Ensure audit evidence is properly maintained, traceable, and available when required.

Required Skills & Qualifications





- Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field.
- 3–7 years of experience in information security, IT audits, cybersecurity compliance, GRC, or IT governance.
- Practical experience coordinating security audits and external security assessment vendors.
- Solid knowledge of VAPT, SAST, DAST, source code reviews, vulnerability management, and remediation tracking.
- Experience preparing information security policies, SOPs, audit responses, and compliance documentation.
- Understanding of IT change management, access control, incident management, backup and disaster recovery processes.
- Familiarity with ISO/IEC 27001, CERT-In guidelines, applicable RBI cybersecurity requirements, and banking vendor security assessments.
- Strong written and verbal communication skills for interacting with banking clients, auditors, vendors, and internal technical teams.
- Good documentation, coordination, follow-up, and stakeholder management skills.

Preferred Qualifications

- Experience working with banking, fintech, financial services, or enterprise technology companies.
- Experience coordinating with CERT-In empanelled audit firms.
- Familiarity with AWS cloud security, server hardening, database security, application security, and API security.
- Experience with audit evidence collection, security remediation verification, and audit closure reporting.
- ISO/IEC 27001 Lead Implementer, Lead Auditor, CISA, CISM, CRISC, or relevant cybersecurity certifications would be an advantage.

Key Deliverables

- Timely completion and closure of security audits.
- Updated information security policies and SOPs.
- Complete change management records and production change evidence.
- Timely responses to banking client security questionnaires and audit observations.
- Effective coordination with external auditors and security assessment vendors.
- Accurate risk registers, compliance trackers, and remediation evidence.
- Timely closure of vulnerabilities and audit findings in coordination with technical teams.

Ideal Candidate Profile The ideal candidate is someone who can independently manage the end-to-end audit and compliance lifecycle, from understanding a bank's requirements and preparing documentation to coordinating external audits, working with technical teams, and submitting evidence for closure. The candidate should be comfortable discussing technical security findings with developers and infrastructure teams while also preparing professional documentation and communicating with banking clients and auditors.

Skill Area

Priority

Banking IT Audits and Compliance

Essential

CERT-In Auditor Coordination and VAPT Closure

Essential

Security Policies and SOP Creation

Essential

IT Change Management

Essential

Audit Evidence and Bank Questionnaire Responses

Essential

AWS, Application and API Security Understanding

Preferred

ISO 27001 / CISA Certification

Advantage

📌 Information Security & IT Compliance Manager (Noida)
🏢 Vspagy
📍 Noida