Information Security Manager
Broad Function:<\/u><\/b>
<\/span><\/div>
<\/span><\/div>
<\/span><\/div>
<\/span><\/div>
The Information Security Manager will be responsible for developing, implementing, and maintaining the organization\u2019s information security strategy, risk framework, policies, and controls. This role requires deep expertise in cyber operations, audit management, risk evaluation, and compliance with security standards such as ISO 27001, SOC 2, and NIST.This is not a coordination\-only role.<\/span><\/span>
The role demands hands\-on ownership to get things done end\-to\-end by working closely with Engineering, DevOps, IT, HR, Operations, and Management. The primary objective of this role is to deliver measurable security outcomes, including certifications, audit closures, hardened systems, and sustained compliance.<\/span><\/span>
<\/div>
<\/div>
The role demands hands\-on ownership to get things done end\-to\-end by working closely with Engineering, DevOps, IT, HR, Operations, and Management. The primary objective of this role is to deliver measurable security outcomes, including certifications, audit closures, hardened systems, and sustained compliance.<\/span><\/span>
<\/div>
<\/div>
Key Roles & Responsibilities (Not Limited To)<\/u><\/b>
<\/span><\/div>
<\/span><\/div>
<\/span><\/div>
<\/span><\/div>
1. Information Security Governance & Policy Management:<\/b><\/span>
<\/span><\/div>
<\/span><\/div>
<\/span><\/div>
<\/span><\/div>
- Define, develop, implement, and continuously improve information security policies, standards, procedures, and guidelines. <\/span>
<\/span><\/span><\/li>- Own and maintain the Information Security Management System (ISMS) aligned with ISO 27001.<\/span>
<\/span><\/span><\/li>- Establish governance frameworks to ensure consistent security implementation across:<\/span>
<\/span><\/span><\/li>- Corporate IT<\/span>
<\/span><\/span><\/li>- Product engineering<\/span>
<\/span><\/span><\/li>- Cloud infrastructure<\/span>
<\/span><\/span><\/li>- Manufacturing/plant environments (IT/OT)<\/span>
<\/span><\/span><\/li>- Ensure alignment with ISO 27001, SOC 2, PCI DSS, GDPR, and client\-specific security requirements.<\/span>
<\/span><\/span><\/li>- Act as the primary point of contact for information security governance across business units.<\/span>
<\/span><\/span><\/li><\/ul>
<\/span><\/div>
<\/b><\/span><\/div>2. Risk Management, Compliance & Audit Ownership:<\/b><\/span>
<\/span><\/div>
<\/span><\/div>- Conduct periodic enterprise risk assessments, threat modeling, and vulnerability assessments across IT, cloud, product, and plant systems. <\/span>
<\/span><\/span><\/li>- Maintain and continuously update:<\/span>
<\/span><\/span><\/li>- Risk registers<\/span>
<\/span><\/span><\/li>- Asset inventories<\/span>
<\/span><\/span><\/li>- Control matrices<\/span>
<\/span><\/span><\/li>- Compliance dashboards<\/span>
<\/span><\/span><\/li>- Lead and independently manage:<\/span>
<\/span><\/span><\/li>- ISO 27001 certification and surveillance audits<\/span>
<\/span><\/span><\/li>- SOC 2 Type I & II audits<\/span>
<\/span><\/span><\/li>- PCI DSS compliance assessments<\/span>
<\/span><\/span><\/li>- Client and partner security audits<\/span>
<\/span><\/span><\/li>- Coordinate audit schedules, evidence collection, documentation, and stakeholder interactions.<\/span>
<\/span><\/span><\/li>- Track, manage, and ensure timely closure of non\-conformities (NCs), observations, and CAPAs.<\/span>
<\/span><\/span><\/li>- Ensure continuous compliance with regulatory, contractual, and customer\-driven security obligations.<\/span>
<\/span><\/span><\/li><\/ul>
<\/span><\/div>
<\/span><\/div>3. Security Operations, Monitoring & Tooling:<\/b><\/span>
<\/span><\/div>
<\/span><\/div>- Oversee day\-to\-day security operations including: <\/span>
<\/span><\/span><\/li>- SIEM monitoring<\/span>
<\/span><\/span><\/li>- Log management<\/span>
<\/span><\/span><\/li>- Threat detection and alerting<\/span>
<\/span><\/span><\/li>- Collaborate with IT and infrastructure teams to strengthen:<\/span>
<\/span><\/span><\/li>- Network security<\/span>
<\/span><\/span><\/li>- Endpoint security<\/span>
<\/span><\/span><\/li>- Identity and access management (IAM)<\/span>
<\/span><\/span><\/li>- Cloud security posture<\/span>
<\/span><\/span><\/li>- Evaluate, implement, and manage security tools such as:<\/span>
<\/span><\/span><\/li>- Firewalls, IDS/IPS<\/span>
<\/span><\/span><\/li>- EDR/antivirus solutions<\/span>
<\/span><\/span><\/li>- DLP solutions<\/span>
<\/span><\/span><\/li>- IAM, MFA, PAM<\/span>
<\/span><\/span><\/li>- Vulnerability management tools<\/span>
<\/span><\/span><\/li>- Define and monitor security KPIs and metrics for management reporting.<\/span>
<\/span><\/span><\/li><\/ul>
4. Incident Response, BCP & Disaster Recovery:<\/b>
<\/span><\/div>
<\/span><\/div>- Develop, maintain, and test Incident Response Plans (IRP). <\/span>
<\/span><\/span><\/li>- Lead investigation, containment, remediation, and root\-cause analysis of:<\/span>
<\/span><\/span><\/li>- Security incidents<\/span>
<\/span><\/span><\/li>- Data breaches<\/span>
<\/span><\/span><\/li>- Vulnerability exploitation.<\/span>
<\/span><\/span><\/li>- Coordinate incident response with internal teams, vendors, and external stakeholders when required.<\/span>
<\/span><\/span><\/li>- Own and enhance Business Continuity Plans (BCP) and Disaster Recovery (DR) frameworks.<\/span>
<\/span><\/span><\/li>- Conduct periodic BCP/DR drills, tabletop exercises, and cyber incident simulations.<\/span>
<\/span><\/span><\/li>- Ensure readiness for ransomware, data breach, and operational disruption scenarios.
<\/span><\/span><\/li><\/ul> - Lead investigation, containment, remediation, and root\-cause analysis of:<\/span>
- SIEM monitoring<\/span>
- Maintain and continuously update:<\/span>
- Own and maintain the Information Security Management System (ISMS) aligned with ISO 27001.<\/span>