Senior InfoSec Engineer

First American (India)

. Perform information security control assessments, including design effectiveness and operating effectiveness testing, for First American Information Security controls .

Posted 11/11/2026full-timeRemote • IndiaSeniorWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in Information Security Control Assessments, including the application of NIST CSF and ISO/IEC 27001/27002 frameworks. Proficient in Governance, Risk & Compliance processes, with strong analytical and communication skills to collaborate effectively with stakeholders.

Highest-signal resume keywords

Information Security Control AssessmentsGovernance, Risk & Compliance (GRC)NIST Cybersecurity Framework (CSF)ISO/IEC 27001/27002CISA, CRISC, CISSP Certifications

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Control TestingRisk ManagementEvidence EvaluationControl Design AssessmentDocumentation of ConclusionsPolicy InterpretationControl Gap RemediationRisk AssessmentSampling TechniquesTest Procedures

Soft Skills

Analytical SkillsCritical ThinkingProblem SolvingAttention to DetailCommunication Skills

Tools & Technologies

ServiceNowGRC ToolsWorkflow Management ToolsTicketing SystemsEvidence Management Tools

Certifications & Qualifications

CISACRISCCISSPISO/IEC 27001

Industry Keywords

Information SecurityRisk AssessmentControl FrameworksAuditCompliance

Tech Stack

Tools & technologies

Cyber SecurityServiceNow

About the role

Key responsibilities & impact

Perform information security control assessments, including design effectiveness and operating effectiveness testing, for First American Information Security controls
Develop and execute control test procedures, identify evidence requirements, evaluate control populations and samples, and document assessment conclusions
Review policies, standards, procedures, system-generated evidence, reports, screenshots, tickets, and other artifacts to determine whether controls are designed and operating as intended
Partner with control owners and Information Security subject matter experts to clarify control execution, obtain evidence, validate exceptions, and communicate observations and gaps
Support Multi-Brand Entity control assessments by evaluating control implementation and evidence across applicable entities and documenting results
Support the Policy Exception Request process, including review, stakeholder and SME coordination, risk assessment inputs, follow-up, tracking, and closure
Perform and support information security risk assessments, including evaluation of inherent risk, likelihood, impact, residual risk, and mitigating controls
Interpret Information Security policies, standards, and control requirements and apply them during control and risk assessments
Apply and reference NIST CSF, ISO/IEC 27001/27002, and other applicable regulatory or control frameworks
Maintain audit-ready assessment workpapers and support tracking of control gaps, remediation actions, due dates, reporting, process improvements, data quality, automation opportunities, and GRC initiatives
Collaborate with U.S.- and India-based stakeholders and provide inputs for GRC leadership and Information Security governance activities

Requirements

What you’ll need

Bachelor's degree in Computer Science, Information Security, Engineering, Risk Management, or equivalent professional experience
7+ years of Information Security experience, with relevant experience in Governance, Risk & Compliance, security controls, audit, or assurance activities
Hands-on experience performing information security control assessments or control testing, including assessment of control design and operating effectiveness
Good understanding of control testing concepts, including evidence evaluation, sampling, control populations, test procedures, exception identification, and documentation of conclusions
Working knowledge of information security risk management concepts, including risk identification, likelihood, impact, inherent risk, residual risk, mitigating controls, and risk treatment
Experience interpreting and applying Information Security policies, standards, procedures, and control requirements
Familiarity with NIST Cybersecurity Framework (CSF), ISO/IEC 27001/27002, related security control frameworks, and common Information Security domains such as IAM, vulnerability management, network security, endpoint security, data security, logging and monitoring, incident response, business continuity, and third-party security
Experience supporting policy exception, risk acceptance, issue management, remediation tracking, or similar governance processes is preferred
Experience with GRC, workflow, ticketing, or evidence-management tools; familiarity with ServiceNow or similar platforms is preferred
Strong analytical, critical-thinking, problem-solving, documentation, and attention-to-detail skills
Strong written and verbal communication skills with the ability to work effectively with technical SMEs, control owners, business stakeholders, and U.S.-based teams
Ability to manage multiple assessments and GRC activities, follow defined methodologies, meet timelines, and escalate issues appropriately
Relevant certifications such as CISA, CRISC, CISSP, ISO/IEC 27001, or equivalent Information Security / GRC certification

Benefits

Comp & perks

Equal Opportunity Employer commitment
Inclusive workplace environment that respects, supports, and inspires all individuals
Diversity and inclusion commitment