Information Security Associate

Required Skills

Nice to have:

Role SummaryWe are seeking a motivated and technically skilled Information Security Associate to join our cybersecurity team. The role is suitable for an early to mid-career information security professional with hands-on experience in security testing, vulnerability assessment, and security operations, along with an interest in Governance, Risk & Compliance (GRC).The successful candidate will support the organization's information security posture through vulnerability assessments, penetration testing, threat analysis, security monitoring, risk assessments, and compliance activities. The role will also contribute to ISO 27001, data privacy, and information security governance initiatives.Key ResponsibilitiesTechnical Security OperationsConduct vulnerability assessments and support VAPT activities across networks, applications, systems, mobile applications, and cloud environments.Identify, validate, prioritize, and report security vulnerabilities and misconfigurations.Support penetration testing and security assessment activities using appropriate tools and methodologies.Participate in red team, blue team, tabletop exercises, security simulations, and cyber resilience assessments.Analyze security events, indicators of compromise, and attack techniques to identify potential security risks.Support remediation activities by coordinating with infrastructure, application, and business teams.Conduct security reviews of applications, systems, infrastructure, and technology implementations.Assist with threat modelling and security risk assessments for new projects and technology deployments.Investigate network-related security issues, including DNS activity, suspicious communications, and traffic anomalies.Support security monitoring, incident analysis, and root cause investigations when required.Maintain security testing methodologies, procedures, and technical documentation.Governance, Risk & ComplianceSupport the implementation and maintenance of information security policies, standards, and procedures.Assist with information security risk assessments, risk treatment, and risk tracking.Contribute to ISO 27001 compliance and continuous improvement initiatives.Support internal and external audits, compliance reviews, and evidence collection.Assist in maintaining security controls aligned with regulatory and organizational requirements.Support privacy and data protection assessments, including PDPA and other applicable requirements.Track security findings, corrective actions, and compliance remediation activities.Contribute to security awareness, governance documentation, and information security communications.Documentation & ReportingPrepare and maintain vulnerability assessment, penetration testing, risk assessment, and security review reports.Maintain risk registers, security findings, remediation trackers, and compliance records.Ensure accurate and consistent documentation of security activities and control validation.Communicate technical security findings clearly to both technical and non-technical stakeholders.Contribute to continuous improvement of information security processes and procedures.