Specialist Cybersecurity - IT Audit Management (PCI, SOC, ISO 27001)

About the role

The Technology Risk Management team, part of the Chief Security Office (CSO), manages external and internal audits, analyzes policy exceptions, runs risk assessments and enforces governance across processes. It works closely with the Technology Services, Cyber Security Risk Management and other CSO teams. This Specialist role covers PCI DSS, SOC and ISO 27001 audits, risk assessments, information security compliance or IT security operations. The location is Bengaluru, India, with a requirement to cover US morning hours.

Key responsibilities

• Develop and maintain internal and external audit plans, including PCI DSS audits, with scope, objectives, deliverables, owners, timelines and dependencies tracked and completed on time.
• Maintain audit process documentation and flows, keeping procedures, roles and responsibilities current.
• Lead the annual Control Owner Assertion (COA) process, completing it at least six weeks before the SOC audit cycle, and drive readiness with Data and Control Owners.
• Facilitate audit kick-offs, including presentations, timelines, communication protocols and audit-request templates, finalized at least two weeks before kick-off.
• Facilitate PCI DSS audits end to end: readiness, evidence requests, control-owner engagement, interviews, walkthroughs, testing support, auditor inquiries, fieldwork and remediation.
• Act as the main link between external auditors and internal Data and Control Owners, scheduling interviews, walkthroughs and fieldwork and ensuring auditors receive access, evidence and support.
• Manage inquiries and clarifications from auditors and internal stakeholders, protecting confidential audit information.
• Review preliminary findings, coordinate responses and track action items through remediation and closure.
• Provide weekly and monthly audit status reports, hold status meetings and drive continuous improvement through training, post-audit reviews and lessons learned.

Required profile

• 5+ years of experience overall.
• 3 years minimum in IT audits, risk assessments, information security compliance or IT security operations.
• Minimum 2 years leading ISO 27001, SOC and PCI audits.
• Desirable: telecom sector experience; certifications such as ISO 27001 Lead Auditor/Implementer, CISSP, CISM, CRISC or CISA.

Required skills

• Strong understanding of cybersecurity frameworks and standards (NIST, ISO 27001, CIS Controls).
• Excellent project management, organizational and communication skills.
• Desirable: familiarity with AI and machine learning in cybersecurity, AI-enabled security tools, and AI governance frameworks.