Senior Information Security Compliance Lead

Overview

Lead enterprise-wide cybersecurity compliance, governance, and assurance programs, including ISO/IEC 27001, SOC 2 Type II, and CMMC, as key compliance advisor for audits, risk management, customer assurance, and security governance.

What you'll do

• Lead enterprise cybersecurity compliance programs, including ISO 27001, SOC 2 Type II, CMMC, NIST Cybersecurity Framework, and related security standards.
• Develop, maintain, and improve information security policies, standards, procedures, and control frameworks.
• Perform gap assessments, risk assessments, and control maturity evaluations.
• Drive remediation efforts and track closure of audit findings and compliance gaps.
• Establish governance metrics, dashboards, and executive reporting.
• Lead external certification audits and surveillance audits for ISO 27001.
• Manage SOC 2 Type II readiness, control testing, evidence collection, and auditor coordination.
• Lead CMMC readiness and certification initiatives, including control implementation and assessment preparation.
• Conduct internal audits and coordinate cross-functional audit activities.
• Manage third-party assessors, auditors, and certification bodies.
• Maintain and improve the Information Security Management System (ISMS).
• Ensure compliance with contractual, customer, regulatory, and industry requirements.
• Support customer security assessments, questionnaires, and external compliance reviews.
• Partner with control owners to ensure effective design and operation of security controls.
• Monitor emerging regulatory and cybersecurity compliance requirements.
• Partner with Legal, Privacy, Internal Audit, Engineering, Infrastructure, and Business teams.
• Provide guidance on compliance obligations and security control requirements.
• Present compliance status, risks, and audit results to senior leadership and executive stakeholders.
• Lead compliance awareness and training initiatives across the organization.
• Identify opportunities to automate compliance monitoring and evidence collection.
• Benchmark cybersecurity compliance practices against industry standards and best practices.
• Drive process improvements to enhance audit readiness and operational efficiency.

What you'll need

• 10-15+ years of experience in Information Security, Cybersecurity Governance, Risk & Compliance (GRC), Audit, or related fields.
• 7+ years leading enterprise cybersecurity compliance programs.
• Hands-on experience managing ISO/IEC 27001 certification programs.
• Hands-on experience managing SOC 2 Type II audits.
• Hands-on experience managing CMMC readiness and certification.
• Hands-on experience managing NIST Cybersecurity Framework assessments.
• Hands-on experience managing internal and external audit programs.
• Experience interacting with executive leadership, external auditors, and customers.
• Experience managing global compliance initiatives across multiple business units and regions.
• ISO/IEC 27001 Lead Auditor certification.
• Deep understanding of ISO/IEC 27001:2022, SOC 2 Trust Services Criteria, CMMC 2.0, NIST 800-171, NIST Cybersecurity Framework (CSF), risk management methodologies, third-party risk management, and security governance and policy management.
• Strong audit, analytical, and problem-solving skills.
• Excellent communication and executive presentation skills.
• Proven ability to influence stakeholders without direct authority.
• Bachelor's degree in Information Security, Computer Science, Information Systems, Cybersecurity, Engineering, or related field.

Nice to have

• Certified Information Systems Auditor (CISA).
• Certified Information Systems Security Professional (CISSP).
• SOC 2 Auditor certification or equivalent audit experience.
• CMMC Certified Professional (CCP), CMMC Certified Assessor (CCA), or equivalent CMMC qualification.

Details

• Location: Bangalore, India.
• Full time, assignee / regular employee.
• Travel: Yes, 10% of the time.
• Relocation eligible: Yes.