Information Security Manager

Role & responsibilities

We are seeking a proactive and well-rounded Information Security professional with 4-6 years of experience across multiple security domains. This role will support the implementation, governance, and continuous improvement of Information Security controls across VFS Global's applications, infrastructure, cloud environments, third-party ecosystem, and business operations.

The ideal candidate should have hands-on experience across security operations, risk management, compliance, vulnerability management, cloud security, and identity & access management, and be comfortable working with internal stakeholders, technology partners, and managed security service providers.

Key Responsibilities

Security Operations & Incident Management

• Coordinate investigation and remediation of security incidents and alerts raised by MSSP/SOC teams.
• Support threat detection, incident response, root cause analysis, and closure activities.
• Track remediation of security findings and ensure SLA compliance.
• Review security monitoring reports and support continuous improvement initiatives.

Governance, Risk & Compliance

• Support ISO 27001, ISO 27017, ISO 27018, PIMS, SOC 2, and client/government security compliance activities.
• Participate in internal audits, certification audits, risk assessments, and control reviews.
• Maintain security policies, standards, procedures, and risk registers.
• Coordinate remediation of audit findings and compliance gaps.

Identity & Access Management

• Conduct periodic access reviews and privileged access validations.
• Support IAM governance activities including joiner, mover, leaver reviews.
• Assess user access risks and recommend improvements.

Vulnerability & Security Assurance

• Manage vulnerability assessment and remediation tracking activities.
• Review VAPT, SAST, DAST, and security assessment reports.
• Coordinate with technology teams to ensure timely closure of findings.
• Support secure configuration reviews and security hardening initiatives.

Cloud & Infrastructure Security

• Support security assessments of cloud platforms and hosted services.
• Review cloud security configurations and security posture reports.
• Participate in security architecture and design reviews.
• Assist in implementation of security controls across infrastructure and cloud environments.

Vendor & Third-Party Security

• Conduct third-party security assessments and vendor due diligence.
• Review supplier compliance with security requirements.
• Track remediation of identified third-party risks.
• Support vendor onboarding and periodic security reviews.

Security Awareness & Continuous Improvement

• Drive security awareness initiatives and phishing simulation programs.
• Support enhancement of security processes, automation opportunities, and reporting capabilities.
• Prepare security dashboards, metrics, and management reports.

Required Skills & Experience

• 4-6 years of Information Security experience.

• Good understanding of:

• Security Operations (SOC/SIEM)

• Vulnerability Management

• Identity & Access Management

• Cloud Security

• Risk Management

• ISO 27001 and Security Governance

• Incident Response

• Third-Party Risk Management

• Experience interacting with business, technology, and vendor teams.

• Ability to manage multiple security initiatives simultaneously.

• Strong analytical, communication, and stakeholder management skills.

Preferred

• Hands-on exposure to Cyber Security technologies.
• Understanding of Application Security findings (SAST/DAST/SCA).
• Familiarity with NIST CSF, CIS Controls, OWASP, and privacy regulations.
• Experience working with MSSP/SOC providers.

Qualifications

• Bachelor's degree in Information Technology, Computer Science, Cyber Security, or elated field.

• Preferred certifications:

• ISO 27001 LA/LI

• CEH

• Security+

• SC-200

• AZ-500

• CC / CISSP (Associate level acceptable)