Information Security Consultant

Accountabilities: Deliver governance, risk, and compliance engagements aligned with recognized frameworks, including ISO 27001, SOC 2, NIST, and relevant regional standards. Conduct gap analyses, security posture assessments, and maturity reviews to identify weaknesses and improvement opportunities. Design and implement security programmes, policies, procedures, risk registers, and control frameworks tailored to client requirements. Guide clients through audit preparation, certification processes, and external security assessments. Develop practical remediation plans and monitor progress to ensure identified gaps are addressed effectively. Provide ongoing security advisory services, including virtual CISO (vCISO)-style support and security programme improvement. Evaluate existing security programmes, risk management practices, controls, and operational processes, recommending realistic improvements. Help clients prioritize security initiatives based on risk exposure, business objectives, and available resources. Lead client meetings, workshops, and risk assessment sessions, engaging with technical teams, operational staff, and senior leadership. Translate technical security and compliance requirements into clear recommendations that different stakeholders can understand and act upon. Build trusted client relationships by asking insightful questions, constructively challenging assumptions, and communicating risks and trade-offs. Take ownership of client engagements and workstreams from planning through delivery, managing multiple priorities and raising risks or blockers proactively. Produce accurate, high-quality client deliverables and maintain consistent consulting standards. Use GRC platforms such as Vanta and contribute to scoping and shaping additional client projects. Share knowledge and expertise with colleagues while supporting the continuous development of the wider GRC team. Requirements: 2–5 years of experience in information security, cybersecurity, risk management, compliance, or governance, risk, and compliance (GRC). Previous consulting or other client-facing experience, ideally supporting external organizations with compliance, assurance, or security improvement initiatives. Practical experience working with at least one recognized security framework, such as ISO 27001, SOC 2, or NIST. Working understanding of how security controls, risk management, and security operations function in practice, beyond theoretical framework requirements. Experience supporting compliance activities, security assessments, or the development and improvement of security programmes. Strong written and verbal communication skills, including confidence in leading client discussions, workshops, and assessment sessions. Ability to manage multiple clients and competing priorities in a structured and organized manner. Confidence working with both technical and non-technical stakeholders, including senior decision-makers. Proactive and self-managing approach, with the ability to work effectively in a fully remote environment. Strong analytical and problem-solving skills, sound professional judgment, and the ability to provide practical, risk-based recommendations. Willingness to continuously learn, develop consulting capabilities, and take on increasing responsibility. Desirable skills and experience: Experience guiding organizations through security certification or external audits. Background in vCISO services, security advisory, or ongoing security programme management. Familiarity with GRC platforms such as Vanta, Drata, or OneTrust. Knowledge of regional security and compliance frameworks, such as NIST SP 800-53, NIST SP 800-171, FedRAMP, or CMMC in the US; Cyber Essentials or CAF in the UK; POPIA in South Africa; or the DPDP Act in India. Relevant professional certifications, such as ISO 27001 Lead Implementer, ISO 27001 Lead Auditor, CISMP, CISA, CISM, or CISSP. Benefits: Fully remote working arrangement within India. Annual leave of 23 days, in addition to 10 Indian public holidays (five national holidays and five state holidays of your choice). One additional paid day off for your birthday. Individual healthcare insurance coverage. Access to an employee mental health and wellbeing platform. Annual professional development and training budget of £2,000. Referral bonus of up to £2,000 for each successful referral. Collaborative working environment with opportunities to contribute to varied cybersecurity projects. Opportunities for continuous professional development and career growth within GRC consulting.