Senior InfoSec Engineer

This is a fully remote position, open to applicants in India.

📋 Description

• Conduct assessments of information security controls, focusing on both design effectiveness and operating effectiveness for First American Information Security controls.

• Create and implement control test procedures, identify necessary evidence, evaluate control samples and populations, and document the findings of assessments.

• Analyze policies, standards, procedures, system-generated evidence, reports, screenshots, tickets, and various artifacts to verify whether controls are designed and functioning as intended.

• Collaborate with control owners and Information Security subject matter experts to clarify control execution, gather evidence, validate exceptions, and communicate findings and gaps.

• Assist in Multi-Brand Entity control assessments by reviewing control implementation and evidence across relevant entities and documenting the outcomes.

• Aid in the Policy Exception Request process, including conducting reviews, coordinating with stakeholders and SMEs, providing risk assessment inputs, and managing follow-ups, tracking, and closure.

• Execute and assist with information security risk assessments, analyzing inherent risk, likelihood, impact, residual risk, and mitigating controls.

• Understand and apply Information Security policies, standards, and control requirements during control and risk assessments.

• Utilize and reference NIST CSF, ISO/IEC 27001/27002, and other pertinent regulatory or control frameworks.

• Keep audit-ready assessment workpapers and assist in tracking control gaps, remediation actions, due dates, reporting, process improvements, data quality, automation opportunities, and GRC initiatives.

• Work collaboratively with stakeholders based in the U.S. and India, providing insights for GRC leadership and Information Security governance activities.

⛳️ Requirements

• A Bachelor’s degree in Computer Science, Information Security, Engineering, Risk Management, or related professional experience.

• Over 7 years of experience in Information Security, particularly in Governance, Risk & Compliance, security controls, audit, or assurance activities.

• Practical experience in conducting information security control assessments or control testing, including evaluating control design and operating effectiveness.

• Solid understanding of control testing principles, including evidence evaluation, sampling, control populations, test procedures, exception identification, and documentation of conclusions.

• Working knowledge of information security risk management concepts, including risk identification, likelihood, impact, inherent risk, residual risk, mitigating controls, and risk treatment.

• Experience in interpreting and applying Information Security policies, standards, procedures, and control requirements.

• Familiarity with the NIST Cybersecurity Framework (CSF), ISO/IEC 27001/27002, relevant security control frameworks, and key Information Security domains such as IAM, vulnerability management, network security, endpoint security, data security, logging and monitoring, incident response, business continuity, and third-party security.

• Preferred experience in supporting policy exception, risk acceptance, issue management, remediation tracking, or similar governance processes.

• Experience with GRC, workflow, ticketing, or evidence-management tools; familiarity with ServiceNow or similar platforms is preferred.

• Strong analytical, critical-thinking, problem-solving, documentation, and attention-to-detail skills.

• Excellent written and verbal communication skills, with the ability to effectively engage with technical SMEs, control owners, business stakeholders, and U.S.-based teams.

• Capability to manage multiple assessments and GRC activities, adhering to defined methodologies, meeting deadlines, and appropriately escalating issues.

• Relevant certifications such as CISA, CRISC, CISSP, ISO/IEC 27001, or equivalent Information Security / GRC certification.

🏝️ Benefits

• Commitment to being an Equal Opportunity Employer.

• An inclusive workplace environment that respects, supports, and inspires all individuals.

• A strong focus on diversity and inclusion.