Innovador Infotech Private Limited
Website:
innovadorinfotech.com
Job details:
Role purpose
The auditor assesses the client's ICT and network infrastructure against ISO/IEC 27001:2022. They turn technical VAPT results into ISO non-conformities that management can act on, and track them to closure.
Key responsibilities
1. Plan and conduct ISO/IEC 27001:2022 internal and compliance audits of the client's ICT infrastructure.
2. Review VAPT reports and map each finding to the relevant Annex A control and ISO clause.
3. Raise non-conformities (major/minor) and observations with clear evidence and risk rating.
4. Audit network equipment — routers, switches, firewalls, load balancers, wireless controllers, VPN gateways — for secure configuration and hardening.
5. Review network architecture, segmentation, access control lists and firewall rule bases.
6. Assess logging, monitoring, patch management, backup and access management practices against ISO controls.
7. Prepare audit reports, gap analyses and Statement of Applicability (SoA) reviews for client management.
8. Agree corrective action plans with system owners and verify closure of non-conformities.
9. Maintain risk register and audit evidence; support external certification and surveillance audits.
10. Brief client stakeholders on compliance status and present findings in review meetings.
Mandatory qualifications & certifications
• B.E./B.Tech/MCA/M.Sc. in Computer Science, IT, Electronics or equivalent.
• ISO/IEC 27001 Lead Auditor certificate (2013 or 2022 version, from an accredited body such as BSI, TÜV, Intertek or DNV) — non-negotiable.
• 5+ years in information security or IT audit, with at least 3 years conducting ISO 27001 audits.
• Hands-on experience reading VAPT reports and mapping findings to ISO 27001 controls.
• Working knowledge of enterprise network equipment and its secure configuration.
• Willing to work onsite in Delhi full time.
Technical skills
Area
What the candidate should know
ISO 27001:2022
Clauses 4–10, Annex A (93 controls), SoA, risk assessment, NC classification
VAPT interpretation
Nessus, Qualys, Burp Suite, Nmap outputs; CVSS scoring; false-positive triage
Network equipment
Cisco, Juniper, Fortinet, Palo Alto, Check Point, Sophos; config review and hardening (CIS benchmarks)
Network security
VLANs, segmentation, ACLs, firewall rule review, VPN, NAC, wireless security
Systems
Windows/Linux server hardening, Active Directory, patch and vulnerability management
Monitoring
SIEM, syslog, log retention and review practices
Indian compliance
CERT-In directions (2022), CERT-In audit guidelines, IT Act 2000, DPDP Act 2023 basics
Reporting
Audit reports, gap analyses, CAPA tracking in Excel/GRC tools
Click on Apply to know more.
