Information Security Engineer

We are hiring our next Information Security Engineer. Roles and Responsibilities: Own and strengthen Unstop's information security framework across websites, applications, APIs, cloud infrastructure, and internal technology systems. Conduct and coordinate Vulnerability Assessment and Penetration Testing (VAPT), identify security risks, and work with Engineering and DevOps teams to ensure timely remediation. Ensure compliance with applicable cybersecurity and data protection regulations, including the DPDP Act and Rules, IT Act, and CERT-In directions. Drive implementation and ongoing adherence to information security standards such as ISO 27001 and SOC 2, based on business requirements. Develop and maintain information security policies, access controls, data protection measures, and secure technology practices across the organisation. Lead internal and external security audits, maintain compliance documentation, and ensure closure of audit observations. Establish cybersecurity risk management, incident response, business continuity, and disaster recovery processes. Assess and manage security risks associated with third-party vendors, SaaS platforms, and technology integrations. Manage enterprise client security assessments, compliance questionnaires, and security-related due diligence requirements. Collaborate with Product, Engineering, IT, Legal, and business teams to integrate security and privacy requirements into technology and organisational processes. Monitor emerging cybersecurity threats, evaluate security tools and controls, and recommend improvements aligned with business needs. Define and report key security metrics, compliance status, and critical risks to leadership, ensuring clear accountability and timely resolution. Qualifications: 3-5 years of proven work experience in related roles Certifications such as CISSP, CISM, CISA, CEH, or ISO 27001 Lead Implementer/Auditor preferred. Experience implementing or maintaining ISO 27001 or SOC 2 controls. Exposure to AWS, Azure, or GCP security. Experience in a high-traffic SaaS, marketplace, or B2B technology platform. Experience managing enterprise security assessments and customer compliance requirements.