Lead Manager

Responsibilities: Closely work with the CISO as the Head of Cyber Security Governance to champion organization wide Cyber Security Governance initiatives in line with the Cyber Security Strategy to ensure the CISO’s agenda is achieved as a whole. For effective Cyber Security Governance & Roadmap across Infosys group of companies (“Infosys” or “Organization” or “Company”) & it’s Subsidiaries with all internal (ISG) and external (non-ISG) Lead Managers to meet Cyber Security Governance objectives including Subsidiary point of contacts. A robust Cyber Security Governance Framework which includes a best-in-class Cyber Security Strategy and its associated roadmap towards achieving its objectives. The Cyber Security Strategy to leverage new technology and threat vectors. A Program Management Office (PgMO) to ensure all critical Cyber Security Programs and Projects are tracked closely and progress reported on a periodic basis and maintain a comprehensive Cyber Security Metrics Program in line with industry best practices such as, ISO 27004 or Information Security Forum (ISF) with on-demand as well as periodic reporting to, councils such as Information Security Council (ISC), Subsidiary Security Councils and, members. The Lead managers and relevant stakeholders on pertinent Cyber Security Risks identified from the Information Security Metrics program. The various Cyber Security Council’s Governance Frameworks and Terms of References (ToR). The Cyber Security RACI in consultation with relevant stakeholders for effective Cyber Security Governance in the organization of minutes of meetings (MoM) of various meetings with CISO involvement and track action items closely and progress is reported on periodic basis with Senior Management, including C-level executives and Board members as and when situation demands required, be able to interface with the Client counterparts and their Leadership to provide the right assurance with regards to Infosys’ Information Security Practices safeguarding their data. Multi-faceted, business-focused Security strategies are implemented which would bridge the gap between technical and business functions while ensuring Security at the same time. The owner of the IT GRC system, liaison with various module owners to drive appropriate decisions which will bring in important improvements on how the system is used individually at a module level and as a GRC system as a whole in a most optimal manner. Align self completely up to date with the activities of other ISG Functions / Groups so as to be able to glean on the issues and whether it is in line with the Cyber Security Strategy and thus the CISO’s agenda. Skills and knowledge expectations: Possess cross-domain knowledge in various areas of Cyber Security such as, but not limited to, Security Forum (ISF) Standards of Good Practice (SoGP) Security Management System (ISMS) based on ISO 27001 and ISO 27002 standards and very strong skills in writing and disbursing of Cyber Security Policies, Processes, Procedures, Standards and Guidelines. Security measurement and monitoring based on ISO 27004 wherein strong skills in Microsoft Office suit products are heavily utilized. Security Audits Cyber Security Framework (CSF) Security Strategy Security Maturity Models in Information Security Risk Management with good experience on various Risk Management practices in either of the following, 27005 Information Security Risk Management Standard 31000 Risk Management Standard and ISF Risk Management best practices good understanding or working knowledge of, assessments and penetration testing security source code reviews management and investigations life cycle Architecture design principles and its applications in real-world scenarios knowledge of various other Best Practices, Standards, Regulatory and Statutory frameworks such as, but not limited to, SSAE-16 / 18, PCI DSS, HIPAA, GLBA, SoX, SANS Critical Security Controls (CSC), Privacy in general but General Data Protection Regulation (GDPR) in particular. Abreast with the fast-changing world of Information Technology and Cyber Security; and liaison with leading Industry bodies / forums and CxO community to share and learn ideas and adopt best practices where possible. 27001 Lead Auditor (LA) or Lead Implementer (LI) Certification Mandatory Certification Mandatory