Senior Cloud & Cyber Security – Info Sec Specialist

Overview

Senior Cloud & Cyber Security Information Security Specialist role focused on developing, assessing and maintaining cloud security standards and control documentation across GCP, AWS and Azure.

What you'll do

• Develop, maintain, implement or assess STIGs, CIS Benchmarks, secure configuration baselines, hardening guides and equivalent technical security standards.
• Produce new or revised cloud STIGs and supporting control documentation that meet SLG quality and governance requirements.
• Document cleanup recommendations and complete remediation of assigned STIG content.
• Create accurate control mappings, assessment procedures, implementation guidance and evidence requirements.
• Prepare complete evidence packages and validation summaries for controls without automated CaC coverage.
• Perform manual control validation, attestation, evidence collection, remediation tracking, exception handling and control approval workflows where automated validation is unavailable.
• Review technical evidence and determine whether it satisfies documented control requirements and assessment procedures.
• Interpret cloud-provider documentation and convert complex technical content into concise, testable and auditable requirements.
• Document review comments, issue dispositions, stakeholder decisions, approvals, exceptions and open dependencies.
• Provide regular delivery-status reporting, including completed work, work in progress, blockers and risks requiring escalation.

What you'll need

• Seven or more years of relevant experience in information security, cloud security, security architecture, security engineering, technology risk, control assessment, or security standards development.
• Demonstrated experience developing, maintaining, implementing or assessing STIGs, CIS Benchmarks, secure configuration baselines, hardening guides, or equivalent technical security standards.
• Practical security knowledge across GCP, AWS and Azure, with strong working experience in at least two of the three cloud platforms and the ability to research requirements for the third.
• Strong understanding of cloud security concepts across identity and access management, networking, compute, containers, serverless services, data protection, encryption and key management, logging, monitoring, vulnerability management and platform governance.
• Working knowledge of Azure Policy, Wiz, AWS Service Control Policies, GCP Organization Policies, CSPM capabilities and automated configuration or compliance assessment approaches.
• Experience reviewing technical evidence and determining whether it satisfies documented control requirements and assessment procedures.
• Experience supporting manual control validation, attestation, evidence collection, remediation tracking, exception handling or control approval workflows where automated validation is unavailable.
• Knowledge of NIST SP 800-53, CIS Controls and Benchmarks, ISO/IEC 27001, zero trust principles and risk-based control design.
• Ability to interpret cloud-provider documentation and convert complex technical content into concise, testable and auditable requirements.
• Strong technical writing, analysis, organization and stakeholder-management skills.
• Ability to work independently, manage multiple assigned deliverables, incorporate review feedback and maintain accurate status reporting in an Agile delivery environment.

Nice to have

• Cloud or security certification such as CCSP, CISSP, AWS Certified Security - Specialty, Microsoft Certified: Azure Security Engineer Associate or Google Professional Cloud Security Engineer.
• Experience in standards and lifecycle governance, security policy, control engineering, cloud governance or technical control testing.
• Experience with infrastructure as code or policy as code using Terraform, CloudFormation, Bicep, ARM templates or equivalent technologies.
• Experience with regulated financial services or another highly regulated industry.
• Experience supporting audit or regulatory examinations and producing audit-defensible evidence packages.
• Familiarity with Jira, Confluence, SharePoint or comparable tools used to manage requirements, evidence, reviews, approvals and delivery status.

Details

• Location: Bangalore, India.