Role & responsibilities

- Own ISO 27001 and SOC 2 Type 2: risk register, internal audits, evidence collection and external audits.
- Write and maintain internal security policies and procedures; run annual security awareness training.
- Administer Microsoft 365 security: Entra ID, Conditional Access, MFA, Defender for Office 365, Purview DLP, Intune and external sharing.
- Run quarterly access reviews across AWS, Azure, GCP and Microsoft 365; enforce least privilege and joiner-mover-leaver.
- Manage secrets and cloud access keys: no long-lived keys, regular rotation and alerting.
- Track vulnerabilities, patching and penetration test findings to closure.
- Add security checks to CI/CD pipelines: code, dependency, container and secret scanning.
- Own the incident response plan and lead incident handling.
- Assess vendors and answer client security questionnaires and audits.

First 90 days

1. Days 130: Learn the ISMS, SOC 2 control set and cloud estate. Produce a gap list of controls documented but not operating.
2. Days 3160: Complete a full access review across all clouds and Microsoft 365. Close credential hygiene gaps: MFA everywhere, no long-lived keys, scoped service roles.
3. Days 6190: Stand up evidence collection for the next SOC 2 period, refresh the incident response plan, and run the first tabletop exercise.

Must-have





- 2+ years in information security, GRC or security engineering.
- Has personally run at least one ISO 27001 certification or surveillance audit and one SOC 2 Type 2 audit cycle.
- Can write explicit, auditable policies and procedures.
- Working knowledge of AWS IAM, VPC, S3 and logging; comfortable reading JSON policies and querying CloudTrail.
- Hands-on Microsoft 365 administration and security: Entra ID, Conditional Access, Defender for Office 365, Purview, Intune and Exchange Online.
- Basic DevOps literacy: Git, CI/CD pipelines, Docker, and where security scans fit into them.
- Has handled or closely supported a real security incident.
- Clear written and spoken English; confident in front of bank auditors.

Preferred candidate profile

- ISO 27001 Lead Implementer or Lead Auditor; CISA, CISM, CISSP or CCSP.
- Microsoft certifications such as MS-102, SC-300, SC-200 or AZ-500; AWS Security Specialty.
- Experience in BFSI or a vendor to Indian banks; familiarity with RBI IT outsourcing guidelines and CERT-In directions.
- Hands-on with Kubernetes (AKS/EKS) and ECS security.
- Experience with software supply chain security and SBOMs.
- Exposure to AI governance or ISO 42001.
- Scripting in Python, Bash or PowerShell to automate evidence and checks.

📌 Information Security & Compliance Engineer (Delhi)
🏢 CLARITY CONSULTING
📍 Delhi