Job Description Assistant Manager, Information Security

Department: Audit & Certification
Position Type: Full-time, replacement position
Minimum Qualification: Engineering Degree
Preferred Certification: ISO 27001 Lead Auditor , CEH, OSCP/OSCP+, GPEN, CREST Registered Penetration Tester (CRT)

Role Summary

Support the organizations information security programmed through vulnerability assessment and penetration testing coordination, compliance management, governance, risk management. The role includes supporting DevSecOps activities, tracking remediation, and publishing security dashboards and management reports.

Key Responsibilities

1. Vulnerability Assessment and Penetration Testing (VA/PT)
- Coordinate VA/PT activities for applications, infrastructure, and networks.
- Review assessment findings and work with technical teams to priorities remediation.
- Track vulnerabilities, remediation timelines, and closure evidence.
- Coordinate retesting and escalate overdue or critical findings.

- Governance, Risk and Compliance (GRC)

- Support information security risk assessments and maintain risk registers.
- Monitor compliance with security policies, standards, and applicable requirements.
- Track control gaps, corrective actions, and risk treatment plans.
- Coordinate with stakeholders to collect and validate compliance evidence.

- DevSecOps

- Support the integration of security activities into the software development lifecycle.
- Coordinate with development and DevOps teams on SAST, DAST, and Software Composition Analysis findings.
- Track application security issues and support remediation verification.
- Promote secure development and deployment practices.

- Dashboards and Management Reporting





- Prepare and publish security dashboards, VA/ PT Status reports, and compliance status updates.
- Report vulnerability trends, audit findings, risk status, and remediation progress.
- Maintain accurate KPI and KRI data for management review.
- Use Microsoft Excel to analyses data and produce clear reports.

Required Skills and Competencies

- Practical knowledge of vulnerability assessment and penetration testing.
- Knowledge of DevSecOps and application security testing.
- Knowledge of governance, risk management, and compliance processes.
- Working knowledge of ISO 27001 requirements and information security controls.
- Proficiency in Microsoft Excel, including PivotTables, lookup functions, formulas, charts, and data analysis.
- Ability to prepare dashboards, management reports, and audit documentation.
- Solid analytical, communication, and stakeholder coordination skills.
- Ability to manage multiple activities and follow through on remediation commitments.

Educational Qualification and Certification

- Mandatory: Engineering Degree from a recognized institution.
- Added advantages: ISO 27001 certification, such as Internal Auditor, Lead Auditor, or Lead Implementer.
- CEH, OSCP/OSCP+, GPEN, CREST Registered Penetration Tester (CRT)

Key Performance Expectations

- Timely coordination and completion of planned security assessments and compliance activities.
- Consistent tracking, follow-up, and escalation of vulnerabilities, risks, and audit observations.
- Verification of remediation evidence and timely coordination of retesting.
- Accurate and timely publication of security dashboards and management reports.
- Effective collaboration with technical and business stakeholders to address identified security and compliance gaps.

📌 Assistant Manager - Information Security (Chennai)
🏢 Tata Communications
📍 Chennai