Information Security Manager

Manager-Information Security, Compliance & Data Protection- Gurgaon

ROLE OVERVIEW
Execution-focused governance role responsible for maintaining the organization's information security, privacy, and compliance posture across ISO 27001/27701, DPDPA, ITGC, third-party risk, and R2v3 requirements. The role owns documentation, audit readiness, and the timely closure of non-conformities, coordinates with internal and regulatory/government stakeholders, and supports contract/DPA reviews, awareness training, and ESG reporting.

KEY RESPONSIBILITY AREAS

• ISO 27001 / 27701 Documentation: Maintain the documentation, policies, procedures, processes, and records required for ISO 27001 and ISO 27701 compliance.

• Audits & NC Closure: Conduct internal audits, support external audits, identify gaps, and track and drive the timely closure of Non-Conformities (NCs), observations, and audit findings.

• Process & Control Documentation: Create, review, update, and monitor process documents, SOPs, policies, and control documentation, working with process owners to implement corrective actions.

• Regulatory & Government Coordination: Coordinate with relevant stakeholders to implement new requirements, including those arising from engagements with government and regulatory bodies such as the Department of Telecommunications

• Third-Party Risk Management: Manage third-party risk assessments and due diligence, including responding to questionnaires, coordinating evidence, and supporting third-party audits and site visits.

• R2v3 Responsible Recycling: Implement and maintain R2v3 (R2 Responsible Recycling Standard) requirements, including downstream due diligence, data sanitisation, secure data wiping, and applicable environmental, factory, and operational controls.

• Evidence & Audit Readiness: Maintain audit-ready evidence and documentation across applicable compliance and operational requirements.

• Contract & DPA Review: Review contracts, Data Processing Agreements (DPAs), and other documents from an information security and privacy perspective, including redlining where required.

• Awareness & Training: Conduct information security and privacy awareness training for employees and relevant stakeholders.

• ESG Reporting: Prepare and maintain ESG-related metrics, policies, documentation, and reports in line with organisational requirements.

  KEY PERFORMANCE INDICATORS

ISO 27001 / 27701 documentation kept current and audit-ready Timely closure of NCs, observations, and audit findings within SLA Third-party risk assessments and due diligence completed within agreed TATR2v3 downstream due diligence and data-sanitization compliance maintained Contract / DPA reviews turned around within SLA Information security and privacy awareness training coverage and completion ESG metrics and reports prepared accurately and submitted on time

QUALIFICATIONS & EXPERIENCE
Education: B.E./B.Tech/B.Sc. in CS/IT/ECE (essential); M.Tech/MCA/MBA-IT/M.Sc. Cybersecurity (preferred). Relevant certifications such as ISO 27001 Lead Auditor / Lead Implementer, ISO 27701, CISA, or a recognised privacy / data-protection certification (preferred).

Experience: 5-6 years with at least 3-4 years in a hands-on InfoSec/compliance role and worked on third-party risk assessments. Exposure to R2v3 and ESG reporting is an advantage.
Should have been part of at least one full ISO 27001 certification cycle.