ISO Analyst

Job Title:

Location:

Summary:

Required / Mandatory Skills:

• 5+ years of experience in information security, with at least 3 years focused on cloud security architecture and compliance
• Strong hands‑on knowledge of AWS and/or GCP cloud services, including:
  • Networking (VPC/VNet, subnets, routing, firewalls)
  • Compute (EC2, GCE)
  • Storage (S3, GCS)
  • IAM, KMS / CMEK
  • Logging and monitoring services
• Experience reviewing and validating cloud architectures for security policy compliance
• Strong understanding of security controls implementation in IaC and CI/CD pipelines (Terraform, policy‑as‑code preferred)
• In‑depth knowledge of compliance and risk frameworks:
  • NIST CSF / NIST 800‑53
  • ISO/IEC 27001
  • SOC 2
  • Enterprise security review processes (ISRP‑style)
• Proven experience producing audit‑ready evidence, compliance reports, and certification documentation
• Excellent communication skills with the ability to explain risk, remediation trade‑offs, and residual risk to diverse stakeholders

Qualification:

• Bachelor’s degree in Information Security, Computer Science, Engineering, or a related field (or equivalent experience)
• Preferred certifications:
  • CISSP, CISM, CRISC
  • CCSK
  • AWS or GCP Security Certifications
  • ISO 27001 Lead Auditor / Implementer

Key Responsibilities:

• Conduct ISRP / ISO security reviews for cloud solutions from design through certification
• Validate cloud architectures against enterprise security policies and control requirements
• Assess residual risks across cloud infrastructure, IAM, networking, encryption, and managed services
• Review and validate preventative, detective, and automated remediation controls
• Map risks and controls to NIST, ISO, and regulatory frameworks and produce gap analyses
• Drive remediation plans, risk exceptions, and residual risk decisions with business owners
• Prepare and maintain audit‑ready documentation, including:
  • Review reports
  • Compliance checklists
  • Evidence bundles
  • Remediation and exception tracking
• Participate in certification gate reviews and provide formal sign‑off recommendations
• Track and report certification progress, outstanding issues, and escalations