Senior InfoSec Engineer

Overview

Support the execution and continuous improvement of Information Security Governance, Risk & Compliance (GRC) activities, with a primary focus on information security control assessments and control testing.

What you'll do

• Perform information security control assessments, including design effectiveness and operating effectiveness testing, for First American Information Security controls.
• Develop and execute control test procedures, identify appropriate evidence requirements, evaluate control populations and samples, and document clear assessment conclusions.
• Review policies, standards, procedures, system-generated evidence, reports, screenshots, tickets, and other artifacts to determine whether controls are designed and operating as intended.
• Partner with control owners and Information Security subject matter experts to clarify control execution, obtain evidence, validate exceptions, and communicate assessment observations and gaps.
• Support Multi-Brand Entity (MBE) control assessments by evaluating control implementation and evidence across applicable entities and documenting assessment results.
• Support execution of the Policy Exception Request (PER) process, including review of exception information, coordination with stakeholders and SMEs, risk assessment inputs, follow-up, tracking, and closure activities.
• Perform and support information security risk assessments, including evaluation of inherent risk, likelihood, impact, residual risk, and relevant mitigating controls using established methodologies.
• Interpret Information Security policies, standards, and control requirements and apply them consistently during control and risk assessments.
• Apply and reference industry frameworks and standards such as NIST Cybersecurity Framework (CSF), ISO/IEC 27001/27002, and other applicable regulatory or control frameworks as required.
• Maintain audit-ready assessment workpapers and support tracking of control gaps, remediation actions, due dates, reporting, process improvements, data quality, automation opportunities, and other GRC initiatives as assigned.
• Collaborate effectively with U.S. and India-based stakeholders and provide timely, concise, and well-supported inputs for GRC leadership and Information Security governance activities.

What you'll need

• Bachelor's degree in Computer Science, Information Security, Engineering, Risk Management, or equivalent professional experience.
• 7+ years of Information Security experience, with relevant experience in Governance, Risk & Compliance, security controls, audit, or assurance activities.
• Hands-on experience performing information security control assessments or control testing, including assessment of control design and operating effectiveness.
• Good understanding of control testing concepts, including evidence evaluation, sampling, control populations, test procedures, exception identification, and documentation of conclusions.
• Working knowledge of information security risk management concepts, including risk identification, likelihood, impact, inherent risk, residual risk, mitigating controls, and risk treatment.
• Experience interpreting and applying Information Security policies, standards, procedures, and control requirements.
• Familiarity with NIST Cybersecurity Framework (CSF), ISO/IEC 27001/27002, related security control frameworks, and common Information Security domains such as IAM, vulnerability management, network security, endpoint security, data security, logging and monitoring, incident response, business continuity, and third-party security.
• Strong analytical, critical-thinking, problem-solving, documentation, and attention-to-detail skills.
• Strong written and verbal communication skills with the ability to work effectively with technical SMEs, control owners, business stakeholders, and U.S.-based teams.
• Ability to manage multiple assessments and GRC activities, follow defined methodologies, meet timelines, and escalate issues appropriately.

Nice to have

• Experience supporting policy exception, risk acceptance, issue management, remediation tracking, or similar governance processes.
• Experience with GRC, workflow, ticketing, or evidence-management tools; familiarity with ServiceNow or similar platforms.
• Relevant certifications such as CISA, CRISC, CISSP, ISO/IEC 27001, or equivalent Information Security / GRC certification.

Details

• Location: Bangalore, Karnataka, India.