Information Security Consultant

This is a fully remote position, open to applicants in India.

📋 Description

• Execute GRC engagements in accordance with frameworks such as ISO 27001, SOC 2, and NIST.

• Conduct gap analyses, security posture assessments, and maturity evaluations.

• Develop and implement security programs, policies, procedures, risk registers, and control frameworks.

• Assist clients in preparing for audits, certifications, and external assessments.

• Create remediation plans and monitor client progress.

• Provide continuous security advisory services, including vCISO-style support.

• Evaluate security programs and recommend enhancements for effectiveness and maturity.

• Aid clients in prioritizing security initiatives based on risk, business objectives, and available resources.

• Analyze risks, controls, and operational practices, offering realistic remediation advice.

• Support specialized security projects and additional client work.

• Facilitate client meetings, workshops, and risk assessment sessions, typically via video call.

• Interpret security and compliance requirements for technical teams, operational staff, and senior leadership.

• Cultivate trusted, long-term relationships with clients.

• Oversee client engagements and workstreams from inception to completion.

• Navigate competing priorities across multiple clients.

• Produce clear and precise deliverables that meet Cognisys standards.

• Utilize GRC platforms such as Vanta and contribute to shaping and scoping additional client work.

• Share expertise with the broader GRC team.

⛳️ Requirements

• 2–5 years of experience in information security, cybersecurity, risk management, compliance, or GRC.

• Experience in consulting or other client-facing roles.

• Hands-on experience with at least one framework, such as ISO 27001, SOC 2, or NIST.

• Working knowledge of security controls, risk management, and operational security practices.

• Experience in supporting compliance, assurance, or security enhancement efforts for external clients.

• Strong written and verbal communication skills, including leading sessions with clients.

• Capability to manage multiple clients and priorities in an organized manner.

• Comfort working with both technical and non-technical stakeholders.

• Experience guiding organizations through certification or external audits.

• Background in vCISO, security advisory, or ongoing security program support.

• Familiarity with GRC platforms such as Vanta, Drata, or OneTrust.

• Knowledge of regional frameworks, e.g., NIST SP 800-53/800-171, FedRAMP, CMMC, Cyber Essentials, CAF, POPIA, or DPDP Act.

• Relevant certifications such as ISO 27001 Lead Implementer or Lead Auditor, CISMP, CISA, CISM, or CISSP.

• Ability to work independently in a remote setting with strong organizational skills.

🏝️ Benefits

• 23 days of annual leave each year, in addition to 10 Indian public holidays (5 national and 5 state holidays of your choice).

• 1 day of paid leave for your birthday.

• Individual healthcare insurance plan.

• Access to an employee mental health and wellbeing platform.

• £2,000 annual training budget.

• Up to £2,000 for each successful referral.