Information Security & IT Compliance Manager

Company: Acadian Technologies Pvt. Ltd.
Product: VSPAGY – Personalized & Interactive Video Communication Platform
Department: Information Security, IT Governance & Compliance
Experience: 3–7 Years
Employment Type: Full-Time
Location: Office-Based
Job Summary
We are looking for a proactive and detail-oriented Information Security & IT Compliance professional to manage security audits, IT compliance, change management, information security policies, and client compliance requirements.
The candidate will be responsible for coordinating with banking clients, external security auditors, CERT-In empanelled audit firms, and internal technical teams to ensure that security assessments, audit observations, and compliance requirements are handled efficiently and within defined timelines.
The role requires a combination of information security knowledge, audit coordination, documentation, risk assessment, and the ability to work with technical teams to achieve audit closure.
Key Responsibilities
1. Security Audits & Compliance Management
Coordinate and manage periodic information security audits and IT audits required by banking and enterprise clients.
Liaise with CERT-In empanelled auditors and other external security assessment agencies.
Coordinate Web Application VAPT, API VAPT, source code reviews, SAST, DAST, infrastructure security assessments, and server configuration audits.
Understand audit observations, coordinate with technical teams for remediation, and track findings until closure.
Maintain audit reports, remediation evidence, closure reports, and compliance documentation.
Prepare responses to security questionnaires, IT audit observations, and compliance requirements received from banks.
Coordinate with clients and auditors during audit discussions, evidence reviews, and closure meetings.
2. Information Security Policies & Documentation
Develop, implement, review, and maintain information security policies, procedures, standards, and guidelines.
Prepare and maintain policies and documents covering:
Information Security Policy
Access Control and User Access Management
Password and Authentication Policy
Change Management Policy
Vulnerability and Patch Management Policy
Incident Response and Management Policy
Backup, Recovery, and Disaster Recovery Policy
Business Continuity and Disaster Recovery (BCP/DR)
Asset Management and Acceptable Use Policy
Data Classification, Retention, and Disposal Policy
Vendor and Third-Party Risk Management Policy
Logging, Monitoring, and Audit Trail Policy
Maintain standard operating procedures (SOPs), process documents, registers, and audit-ready evidence.
Review policies periodically and update them based on applicable regulatory, contractual, and customer requirements.
3. IT Change Management
Manage the change management process for application, database, infrastructure, and security-related changes.
Ensure changes are supported by change requests, impact assessments, risk assessments, approvals, testing evidence, implementation plans, and rollback plans.
Maintain a change management register and ensure proper documentation of production releases and configuration changes.
Coordinate with development, DevOps, infrastructure, and operations teams to collect required evidence.
Ensure changes follow defined approval and release management procedures.
Track emergency changes, post-implementation reviews, and exceptions.
4. Banking Client Compliance
Review and respond to IT security questionnaires, vendor risk assessments, and compliance checklists received from banks.
Coordinate with client IT, information security, risk, and audit teams.
Prepare technical and management responses for security observations, audit findings, and compliance requirements.
Maintain evidence for security controls, including access reviews, vulnerability remediation, backup verification, logging, encryption, incident management, and disaster recovery testing.
Support compliance requirements arising from applicable RBI directions, CERT-In requirements, contractual obligations, and relevant security standards.
Maintain records of compliance status, pending observations, action owners, and target closure dates.
5. Vendor & Third-Party Management
Coordinate with external audit firms, CERT-In empanelled auditors, penetration testing vendors, and security consultants.
Schedule assessments, share approved scope and required documents, facilitate access to the appropriate technical teams, and track assessment progress.
Review audit deliverables for completeness and coordinate clarification of findings with the auditor.
Track vendor deliverables, remediation retesting, final reports, and closure certificates or letters where applicable.
Maintain vendor assessment records, engagement documents, reports, and compliance evidence.
Support third-party risk assessments and periodic vendor security reviews.
6. Risk Management & Security Governance
Maintain risk registers, audit observation trackers, corrective action plans, and compliance dashboards.
Assist in vulnerability management, risk assessment, security incident documentation, and corrective and preventive action (CAPA) tracking.
Coordinate periodic access reviews, asset reviews, backup checks, security configuration reviews, and disaster recovery drills.
Identify gaps in existing processes and recommend improvements to strengthen security governance.
Ensure audit evidence is properly maintained, traceable, and available when required.
Required Skills & Qualifications
Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field.
3–7 years of experience in information security, IT audits, cybersecurity compliance, GRC, or IT governance.
Practical experience coordinating security audits and external security assessment vendors.
Strong knowledge of VAPT, SAST, DAST, source code reviews, vulnerability management, and remediation tracking.
Experience preparing information security policies, SOPs, audit responses, and compliance documentation.
Understanding of IT change management, access control, incident management, backup and disaster recovery processes.
Familiarity with ISO/IEC 27001, CERT-In guidelines, applicable RBI cybersecurity requirements, and banking vendor security assessments.
Strong written and verbal communication skills for interacting with banking clients, auditors, vendors, and internal technical teams.
Good documentation, coordination, follow-up, and stakeholder management skills.
Preferred Qualifications
Experience working with banking, fintech, financial services, or enterprise technology companies.
Experience coordinating with CERT-In empanelled audit firms.
Familiarity with AWS cloud security, server hardening, database security, application security, and API security.
Experience with audit evidence collection, security remediation verification, and audit closure reporting.
ISO/IEC 27001 Lead Implementer, Lead Auditor, CISA, CISM, CRISC, or relevant cybersecurity certifications would be an advantage.
Key Deliverables
Timely completion and closure of security audits.
Updated information security policies and SOPs.
Complete change management records and production change evidence.
Timely responses to banking client security questionnaires and audit observations.
Effective coordination with external auditors and security assessment vendors.
Accurate risk registers, compliance trackers, and remediation evidence.
Timely closure of vulnerabilities and audit findings in coordination with technical teams.
Ideal Candidate Profile
The ideal candidate is someone who can independently manage the end-to-end audit and compliance lifecycle, from understanding a bank's requirements and preparing documentation to coordinating external audits, working with technical teams, and submitting evidence for closure.
The candidate should be comfortable discussing technical security findings with developers and infrastructure teams while also preparing professional documentation and communicating with banking clients and auditors.
Skill Area
Priority
Banking IT Audits and Compliance
Essential
CERT-In Auditor Coordination and VAPT Closure
Essential
Security Policies and SOP Creation
Essential
IT Change Management
Essential
Audit Evidence and Bank Questionnaire Responses
Essential
AWS, Application and API Security Understanding
Preferred
ISO 27001 / CISA Certification
Advantage

Work arrangement
No