Information Security Engineer

Job Description : Information Security Governance Analyst

About GUS India

GUS Education India (GEI) is the education arm of Global University Systems, a leading global education conglomerate. Established in 2017, GEI boasts a portfolio of over 35 institutions and collaborates with prestigious universities and institutions worldwide, offering educational services that enhance their operations and impact.

Nature of the Job

A full-time Manager / Senior Manager-level Information Security Governance and Assurance role responsible for strengthening information security governance and technology risk management across the organisation.

The role operates within Information Security / Governance, Risk & Compliance (GRC) and works closely with Technology, Development, Infrastructure, Data, Privacy, Legal, Risk and Compliance teams, providing independent challenge while partnering with delivery teams.

Desired Profile

Qualification

Required:

• Bachelor's degree in Information Security, Cybersecurity, Computer Science, Information Technology or a related discipline.

Preferred Certifications:

• CISSP (strongly preferred)
• ISO 27001 Lead Auditor
• CISA
• CompTIA Security+

Skills

• Strong information security governance and risk management experience.
• Demonstrable ability to independently lead and manage ISO 27001 / ISMS activities.
• Strong understanding of application security and OWASP / OWASP Top 10.
• Practical understanding of application security testing methodologies, including SAST, DAST, API security and vulnerability testing.
• Working knowledge of IT General Controls (ITGC).
• Good understanding of IT infrastructure, cloud and development environments from a security and risk perspective.
• Strong understanding of security controls, risk assessment and audit/assurance processes.
• Strong stakeholder management and communication skills, with the ability to provide independent challenge to Technology and Business stakeholders.
• Good working knowledge of managing and maintaining policy management frameworks.
• Good working knowledge of GRC platforms such as MetricStream or Archer.

Relevant Experience

• 10+ years of overall professional experience in Information Security, Cybersecurity, Information Risk, GRC or a related discipline.
• Experience in vulnerability management, security assessments and remediation governance.
• Experience conducting or governing application security testing with engineering teams.
• Experience in risk assessments, control validation and audit readiness
• Principal Accountabilities

1. Information Security Governance

• Develop and maintain the information security controls framework, standards, risk and controls register, and governance requirements.
• Provide independent challenge on information security risks, control gaps and exceptions.
• Track and escalate material security risks, control failures and overdue remediation.
• Support the continued development and improvement of the organisation's Information Security Management System (ISMS) and ISO 27001 framework.

2. Application Security & Testing

• Define and oversee application security testing across the Software Development Lifecycle (SDLC), including SAST, DAST, API and vulnerability testing, as appropriate.
• Review security testing findings and prioritise remediation based on risk.
• Track closure of critical and high-risk vulnerabilities.
• Promote secure-by-design principles and ensure security requirements are considered before applications move into production.
• Maintain strong awareness of OWASP, the OWASP Top 10 and emerging application security practices.

3. Technology Risk & Vulnerability Management

• Perform information security risk and control assessments for applications, integrations, cloud services and technology initiatives.
• Validate the effectiveness of key security controls and identify areas requiring improvement.
• Oversee vulnerability remediation governance, including prioritisation, ageing, risk acceptance and escalation.
• Identify recurring vulnerabilities and control weaknesses and drive appropriate corrective actions.

4. Data, Privacy & Third-Party Security

• Assess controls protecting sensitive and critical information, including data classification, access, retention and movement across platforms.
• Review information security risks associated with vendors, integrations and third-party technology services.
• Work with Data, Privacy, Legal, Technology and other stakeholders to assess and manage third-party security risks.

5. Audit, Compliance & Assurance

• Act as the information security interface for internal and external audits, compliance reviews and control assessments.
• Maintain audit-ready evidence, documentation and traceability of security controls.
• Support ISO 27001 audits and ensure timely closure of audit findings and non-conformities.
• Prepare security risk, control and remediation reports for Risk & Compliance and senior leadership.
• Provide clear visibility of material security exposures and remediation status.

6. Security Awareness & Continuous Improvement

• Promote information security standards and awareness across Technology and Business teams.
• Identify opportunities to improve security controls, monitoring, processes and automation.
• Keep current with application, cloud and emerging technology security practices.
• Monitor relevant changes to information security standards, regulatory expectations and industry best practices.