: Information Security

Company: Kapstone Technological Services LLP Location: Mahape, Navi Mumbai, Maharashtra

Experience: 3–5 Years

Employment Type: Full-Time

Work Mode: On-site

About Kapstone

Kapstone Technological Services LLP provides technology and consulting services to help organizations strengthen their IT infrastructure, cybersecurity posture, governance, risk management, and regulatory compliance. We are looking for a skilled and hands-on Information Security Manager with strong expertise in Information Security Governance, Risk & Compliance (GRC), ISO 27001 implementation, and technical security controls. The candidate will work closely with clients to assess their security posture, recommend improvements, implement security frameworks, and support audit and compliance requirements.

Key Responsibilities

1. Information Security Consulting & Client Management

- Consult with clients to understand their information security requirements, business risks, and compliance obligations.
- Conduct security assessments, gap analyses, and risk assessments, and recommend practical remediation measures.
- Guide clients through information security framework implementation, control improvement, and compliance readiness.
- Coordinate with client stakeholders, internal technical teams, auditors, and management to drive security initiatives.

2. ISO 27001:2022 Implementation

- Independently support and execute end-to-end ISO 27001:2022 ISMS implementation for clients.
- Conduct gap assessments, define the scope of the ISMS, perform risk assessments, and develop risk treatment plans.
- Prepare and maintain the Statement of Applicability (SoA), risk registers, information security policies, procedures, and required ISMS documentation.
- Implement and monitor applicable security controls and maintain evidence of implementation.
- Support internal audits, external certification audits, corrective actions,



and continual improvement activities.

3. Governance, Risk & Compliance (GRC)

- Identify, evaluate, and document information security risks and recommend appropriate risk mitigation strategies.
- Assess compliance against ISO 27001, NIST Cybersecurity Framework, SOC 2, and PCI DSS, wherever applicable.
- Perform security control reviews, compliance assessments, vendor risk assessments, and policy reviews.
- Track audit findings, non-conformities, corrective actions, and compliance deliverables.

4. Technical Security & Implementation

- Possess practical knowledge of vulnerability assessment, vulnerability management, and remediation tracking.
- Understand and assess network security, endpoint protection, access management, privileged access, and security monitoring controls.
- Support incident response processes, root-cause analysis, and corrective and preventive actions.
- Understand SIEM operations, security log monitoring, threat identification, and incident escalation.
- Work with technical teams to verify that recommended security controls are implemented effectively.

5. Client Deliverables & Reporting

- Prepare professional security assessment reports, risk assessment reports, gap analysis reports, audit evidence, and remediation plans.
- Present security findings, risks, and recommendations to client stakeholders.
- Monitor implementation progress, maintain project documentation, and provide regular status updates.
- Conduct security awareness sessions and guide clients on improving their overall security posture.





Required Skills & Qualifications

- Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field.
- 3–5 years of relevant experience in Information Security, Cybersecurity Consulting, GRC, ISMS, or Security Auditing.
- Strong practical knowledge of ISO 27001:2022 implementation, preferably with experience executing implementation activities for clients or organizations.
- Hands-on experience with risk assessments, gap assessments, risk treatment plans, SoA, security policies, and audit preparation.
- Good understanding of technical security controls, vulnerability management, access control, endpoint and network security, and incident management.
- Ability to interpret security requirements and translate them into practical, implementable controls.
- Robust client-facing communication, analytical, documentation, presentation, and stakeholder management skills.
- Ability to manage multiple client requirements and work independently with minimal supervision.

Preferred Certifications

- ISO/IEC 27001:2022 Lead Implementer

- ISO/IEC 27001 Lead Auditor
- CISSP, CISM, CISA, or other relevant cybersecurity certifications

Ideal Candidate Profile

We are looking for a candidate who has actually implemented ISO 27001:2022 and information security controls, rather than someone whose experience is limited to documentation, theoretical knowledge, or audit coordination. The ideal candidate should be comfortable consulting with clients, identifying security gaps, recommending solutions, coordinating implementation, validating control effectiveness, and supporting clients through audit and certification readiness.

Interested candidates can share their updated resumes at: [email protected]

Contact: Fatima | (phone hidden)

Pay: ₹20,000.00 - ₹70,000.00 per month

Work Location: In person

📌 Information Security Engineer (Navi Mumbai)
🏢 Kapstone Technological services
📍 Navi Mumbai