Information Security Engineer

Skills this role screens for

About the role

We are hiring our next Information Security Engineer.

The work

Roles and Responsibilities

• Own and strengthen Unstop's information security framework across websites, applications, APIs, cloud infrastructure, and internal technology systems.
• Conduct and coordinate Vulnerability Assessment and Penetration Testing (VAPT), identify security risks, and work with Engineering and DevOps teams to ensure timely remediation.
• Ensure compliance with applicable cybersecurity and data protection regulations, including the DPDP Act and Rules, IT Act, and CERT-In directions.
• Drive implementation and ongoing adherence to information security standards such as ISO 27001 and SOC 2, based on business requirements.
• Develop and maintain information security policies, access controls, data protection measures, and secure technology practices across the organisation.
• Lead internal and external security audits, maintain compliance documentation, and ensure closure of audit observations.
• Establish cybersecurity risk management, incident response, business continuity, and disaster recovery processes.
• Assess and manage security risks associated with third-party vendors, SaaS platforms, and technology integrations.
• Manage enterprise client security assessments, compliance questionnaires, and security-related due diligence requirements.
• Collaborate with Product, Engineering, IT, Legal, and business teams to integrate security and privacy requirements into technology and organisational processes.
• Monitor emerging cybersecurity threats, evaluate security tools and controls, and recommend improvements aligned with business needs.
• Define and report key security metrics, compliance status, and critical risks to leadership, ensuring clear accountability and timely resolution.

Who they want

Qualifications

• 3-5 years of proven work experience in related roles
• Certifications such as CISSP, CISM, CISA, CEH, or ISO 27001 Lead Implementer/Auditor preferred.
• Experience implementing or maintaining ISO 27001 or SOC 2 controls.
• Exposure to AWS, Azure, or GCP security.
• Experience in a high-traffic SaaS, marketplace, or B2B technology platform.
• Experience managing enterprise security assessments and customer compliance requirements.