Information Security Consultant

Accountabilities

• Deliver governance, risk, and compliance engagements aligned with recognized frameworks, including ISO 27001, SOC 2, NIST, and relevant regional standards.

• Conduct gap analyses, security posture assessments, and maturity reviews to identify weaknesses and improvement opportunities.

• Design and implement security programmes, policies, procedures, risk registers, and control frameworks tailored to client requirements.

• Guide clients through audit preparation, certification processes, and external security assessments.

• Develop practical remediation plans and monitor progress to ensure identified gaps are addressed effectively.

• Provide ongoing security advisory services, including virtual CISO (vCISO)-style support and security programme improvement.

• Evaluate existing security programmes, risk management practices, controls, and operational processes, recommending realistic improvements.

• Help clients prioritize security initiatives based on risk exposure, business objectives, and available resources.

• Lead client meetings, workshops, and risk assessment sessions, engaging with technical teams, operational staff, and senior leadership.

• Translate technical security and compliance requirements into clear recommendations that different stakeholders can understand and act upon.

• Build trusted client relationships by asking insightful questions, constructively challenging assumptions, and communicating risks and trade-offs.

• Take ownership of client engagements and workstreams from planning through delivery, managing multiple priorities and raising risks or blockers proactively.

• Produce accurate, high-quality client deliverables and maintain consistent consulting standards.

• Use GRC platforms such as Vanta and contribute to scoping and shaping additional client projects.

• Share knowledge and expertise with colleagues while supporting the continuous development of the wider GRC team.

Requirements:

• 2–5 years of experience in information security, cybersecurity, risk management, compliance, or governance, risk, and compliance (GRC).

• Previous consulting or other client-facing experience, ideally supporting external organizations with compliance, assurance, or security improvement initiatives.

• Practical experience working with at least one recognized security framework, such as ISO 27001, SOC 2, or NIST.

• Working understanding of how security controls, risk management, and security operations function in practice, beyond theoretical framework requirements.

• Experience supporting compliance activities, security assessments, or the development and improvement of security programmes.

• Strong written and verbal communication skills, including confidence in leading client discussions, workshops, and assessment sessions.

• Ability to manage multiple clients and competing priorities in a structured and organized manner.

• Confidence working with both technical and non-technical stakeholders, including senior decision-makers.

• Proactive and self-managing approach, with the ability to work effectively in a fully remote environment.

• Strong analytical and problem-solving skills, sound professional judgment, and the ability to provide practical, risk-based recommendations.

• Willingness to continuously learn, develop consulting capabilities, and take on increasing responsibility.

Desirable skills and experience:

• Experience guiding organizations through security certification or external audits.

• Background in vCISO services, security advisory, or ongoing security programme management.

• Familiarity with GRC platforms such as Vanta, Drata, or OneTrust.

• Knowledge of regional security and compliance frameworks, such as NIST SP 800-53, NIST SP 800-171, FedRAMP, or CMMC in the US; Cyber Essentials or CAF in the UK; POPIA in South Africa; or the DPDP Act in India.

• Relevant professional certifications, such as ISO 27001 Lead Implementer, ISO 27001 Lead Auditor, CISMP, CISA, CISM, or CISSP.

Benefits:

• Fully remote working arrangement within India.

• Annual leave of 23 days, in addition to 10 Indian public holidays (five national holidays and five state holidays of your choice).

• One additional paid day off for your birthday.

• Individual healthcare insurance coverage.

• Access to an employee mental health and wellbeing platform.

• Annual professional development and training budget of £2,000.

• Referral bonus of up to £2,000 for each successful referral.

• Collaborative working environment with opportunities to contribute to varied cybersecurity projects.

• Opportunities for continuous professional development and career growth within GRC consulting.