Information Security- GRC

Overview

Lead day-to-day execution of Fluke's information security audit, certification, third-party risk and customer security assurance programs, serving as primary liaison to external auditors and Internal Audit.

What you'll do

• Lead SOX ITGC and ITAC control execution, including quarterly and occurrence-based control performance, control testing, roll-forward inquiries and evidence submission in partnership with the external auditor and Fortive Internal Audit.
• Act as primary audit liaison: lead walkthroughs, manage PBC and evidence requests, translate auditor follow-ups into requirements for control owners, and deliver complete evidence before deadlines.
• Coordinate evidence across key systems including ERP, data and analytics platforms, and change-management tooling, covering privileged access, change management, key reports / IPE and ITAC configurations.
• Maintain segregation of duties within the test / review / sign-off model, performing control testing and secondary review as required.
• Track and report control status, remediation items and prior-year improvement opportunities to GRC leadership and Finance stakeholders; act as SOX lead during the Compliance Lead's absence.
• Own ISO 27001 control operations, including control ownership, quarterly access reviews, control evaluations, corrective actions, surveillance and recertification audits, and onboarding new products into scope.
• Lead or support SOC 2 Type II and Cyber Essentials / CE+ audits from scoping and kickoff through auditor facilitation and evidence collection.
• Own completion of customer security questionnaires and RFP / RFI security sections for Fluke products, software and services, coordinating with Product Security, Engineering, IT, Legal and Sales.
• Maintain an approved answer library and supporting evidence (policies, certifications, SOC 2 reports, penetration test summaries) and keep Trust Center content current.
• Support customer and supplier security audits and assessments, and track security commitments made to customers through to closure.
• Escalate product-specific gaps or contractual security requirements to Product Security and Legal, and feed recurring customer asks back into the control program.
• Maintain framework mappings (SOX, ISO 27001, SOC 2, NIST 800-171 / CMMC, NIS2, PCI DSS, EU Data Act) to a unified control set.
• Support EU Cyber Resilience Act compliance with Product Security / PSIRT, and monitor and gap-assess new cybersecurity regulations with Fluke Compliance teams.
• Own the third-party risk management process from intake to closure: scoping, risk tiering, determining TPRM scope, conducting vendor security assessments, reviewing questionnaires, SOC reports, certifications and contract security terms, and documenting risk-based approvals and remediation.
• Partner with Procurement, Legal and business owners on vendor reviews, establish ongoing monitoring for critical suppliers and AI-specific vendor review criteria.
• Maintain the information security risk register and risk-acceptance process, including risk assessments, owner accountability, expiring acceptances and migration of legacy risk records.
• Drive corrective actions and overdue control evaluations to closure, support enterprise risk reviews and the Risk Profile including IAM / MFA metrics, and prepare risk reporting for InfoSec leadership.
• Administer and improve GRC tooling as the system of record for controls, including control design by framework, dashboards, control-gap reports and auditor-facing access; drive evidence automation and continuous control monitoring.
• Author and maintain SOPs, guidelines and policies.

What you'll need

• 5+ years in IT compliance, IT audit or GRC related roles.
• Demonstrated experience as the primary liaison with external auditors, leading walkthroughs, managing evidence requests and remediating findings within audit timelines.
• Working knowledge of ISO 27001 ISMS operation and certification audits, and experience supporting SOC 2 Type II.
• Familiarity with additional frameworks such as NIST 800-171 / CMMC, Cyber Essentials, EU CRA and NIS2.
• Hands-on third-party and enterprise risk management experience: vendor security assessments, SOC report review, risk tiering, risk registers and risk-acceptance workflows.
• Experience completing customer security questionnaires (e.g., SIG, CAIQ or custom customer assessments) and RFP security responses, ideally for hardware, software or SaaS products.
• Hands-on experience with a GRC platform.
• Proven ability to lead multiple concurrent audits and workstreams independently and meet fixed deadlines.
• Effective written and verbal communication, with the ability to explain complex compliance requirements to technical and non-technical stakeholders.
• Demonstrated ability to work collaboratively with colleagues at all levels, including global teams.
• High level of integrity and ethics, maintaining confidentiality and professionalism in handling sensitive information.

Nice to have

• Professional certification: CISA, CRISC, CISSP, CISM, or ISO 27001 Lead Auditor / Lead Implementer.
• Experience with emerging requirements such as the EU Cyber Resilience Act, product security compliance, or AI governance frameworks (EU AI Act, NIST AI RMF, ISO/IEC 42001).
• Familiarity with product security standards and practices (e.g., IEC 62443, secure development lifecycle, SBOM, coordinated vulnerability disclosure).
• Experience harmonizing controls across frameworks (e.g., Secure Controls Framework) and automating evidence collection.
• Experience in a manufacturing, industrial technology or multinational, matrixed environment.

Details

• Remote, India.
• Reports to the Senior Information Security Compliance Lead; expected to operate independently on core audit programs within the first six months following structured onboarding.