MLVeda
Website:
mlveda.com
Job details:
Position summaryWe are seeking an Information Security & Compliance Manager to establish, operate, and continually improve our Information Security Management System (ISMS) and security compliance program. The role will lead our readiness and ongoing compliance for ISO/IEC 27001:2022 certification and SOC 2 reporting.
The successful candidate will translate security and compliance requirements into practical processes for a growing IT organization, coordinate technical and business teams, maintain audit-ready evidence, manage security risks and incidents, and report security performance to senior management.
Key responsibilities1. ISMS, governance, and policy management- Establish, maintain, and improve the company’s ISMS in line with ISO/IEC 27001:2022.
- Define and maintain the ISMS scope, information-security objectives, interested-party requirements, Statement of Applicability (SoA), risk-treatment plan, and compliance obligations register.
- Draft, maintain, communicate, and periodically review security policies, standards, procedures, and records.
- Ensure policies and procedures are practical for the company’s actual working model, including remote work, cloud services, software development, support operations, and customer-data handling.
- Maintain a clear RACI/responsibility matrix for security controls, including control owners, evidence owners, approvers, reviewers, and escalation paths.
- Organize management-review meetings, prepare security metrics and risk reports, record decisions, and track actions to closure.
- Coordinate internal audits, external certification audits, SOC 2 readiness assessments, and SOC 2 examinations.
2. SOC 2 program and audit evidence- Lead SOC 2 readiness and maintain compliance with the applicable Trust Services Criteria.
- Work with management and the auditor to determine the appropriate SOC 2 scope—normally Security first, with Availability, Confidentiality, Processing Integrity, and/or Privacy included only where required by customers and services.
- Maintain a control matrix mapping SOC 2 requirements to company policies, processes, technical configurations, control owners, and evidence.
- Create and manage an evidence calendar covering monthly, quarterly, annual, and event-driven controls.
- Collect, validate, organize, and retain audit evidence, such as access-review records, onboarding/offboarding records, change approvals, vulnerability reports, training completion, incident records, backup-testing results, supplier reviews, and management-review minutes.
- Coordinate with external auditors and respond to audit queries, exceptions, corrective actions, and remediation requests.
- Ensure evidence proves that controls operated consistently throughout the SOC 2 audit period, especially for a Type II report.
SOC 2 readiness typically requires demonstrable evidence around risk assessment, access controls, monitoring, incident response, vendor management, change management, and security awareness—not merely written policies.
3. Risk management and compliance- Establish and manage the information-security risk-assessment methodology, risk register, treatment plans, risk owners, due dates, and risk-acceptance process.
- Conduct periodic and change-triggered risk assessments for systems, products, projects, new vendors, cloud services, and material changes.
- Track legal, contractual, and customer security requirements relevant to the business.
- Identify control gaps, assess impact and likelihood, recommend treatment options, and escalate overdue or high risks to leadership.
- Monitor compliance with security policies and coordinate corrective and preventive actions.
4. Technical security oversight- Partner with IT, DevOps, engineering, HR, and operations teams to implement and monitor security controls.
- Oversee identity and access management, including least privilege, MFA, privileged-access controls, joiner-mover-leaver processes, and periodic access reviews.
- Coordinate vulnerability management, patching, endpoint protection, secure configuration baselines, log monitoring, and remediation tracking.
- Review cloud and SaaS security configurations, including AWS/Azure/GCP, Microsoft 365/Google Workspace, source-code repositories, ticketing systems, CRM, and backup platforms, as applicable.
- Ensure secure development and change-management practices are documented and followed, including code review, testing, deployment approval, and emergency-change processes.
- Review backup, disaster-recovery, and business-continuity arrangements; coordinate periodic tests and document outcomes.
- The role may oversee these activities but does not need to personally administer every platform. Technical system owners should execute relevant controls and provide evidence.
5. Incident management and awareness- Maintain and test the incident-response plan, incident-severity model, internal escalation process, and customer-notification process.
- Coordinate security incident investigation, containment, recovery, post-incident review, root-cause analysis, and improvement actions.
- Maintain the incident register and ensure lessons learned are converted into tracked improvements.
- Develop and deliver security-awareness training for employees, contractors, and relevant third parties.
- Conduct onboarding security briefings and periodic phishing, password, data-handling, and acceptable-use awareness activities.
- Monitor completion of mandatory training and follow up on non-compliance.
6. Vendor and customer assurance- Maintain an inventory of suppliers, cloud providers, SaaS tools, and sub-processors that access company or customer information.
- Perform and document vendor due diligence and risk assessments before onboarding critical vendors and on a defined review cycle afterward.
- Ensure vendor contracts include appropriate security, confidentiality, incident-notification, data-return/deletion, and audit/assurance clauses.
- Collect and assess relevant vendor assurance documents, such as SOC reports, ISO certificates, penetration-test summaries, and security questionnaires.
- Support customer security questionnaires, RFPs, due-diligence requests, and contract-security reviews.
Authority and accountabilityThe Information Security & Compliance Manager will be authorized to:
- Request evidence and control-status updates from all departments.
- Require documented remediation plans for identified control gaps.
- Escalate unresolved high-risk issues directly to the CEO/CTO or security steering committee.
- Recommend suspension or restriction of access where a material security risk exists.
- Coordinate incident response across departments.
- Report independently on the effectiveness of the ISMS and SOC 2 controls.
Essential qualifications- 3+ years of experience in information security, IT governance, GRC, internal audit, IT operations, cloud security, or compliance.
- Practical experience implementing or operating ISO 27001, SOC 2, or a comparable control framework.
- Strong understanding of risk assessments, risk registers, control design, evidence collection, internal audits, and corrective-action tracking.
- Working knowledge of access management, MFA, endpoint security, patching, backups, vulnerability management, logging, incident response, and cloud/SaaS security.
- Experience working with tools such as Jira/Freshdesk, Google Workspace or Microsoft 365, GitHub/GitLab, cloud platforms, HRMS, endpoint-management tools, and compliance/evidence platforms.
- Ability to write clear policies, procedures, risk reports, audit responses, and management presentations.
- Strong stakeholder-management skills; able to influence engineering, HR, operations, and leadership without creating unnecessary bureaucracy.
- High integrity, discretion, organization, and attention to detail.
Click on Apply to know more.
