ISMS Consultant – ISO/IEC 27001 and Privacy

You implement information security, privacy and assurance programmes for technology companies, BPOs, financial-services firms and healthcare providers: ISO/IEC 27001:2022 and ISO/IEC 27701, SOC 2 readiness, PCI DSS and data-protection compliance. You translate control requirements into controls the client can run, and you work closely with Cyber Vantage 360, Sterling's cybersecurity practice.

• Define ISMS scope, context and risk methodology; lead risk assessment and treatment
• Build the Statement of Applicability and implement the Annex A controls with IT, HR, legal and operations
• Write policies, procedures and records the client will maintain
• Map ISO/IEC 27001 controls to SOC 2 Trust Services Criteria and PCI DSS requirements for clients that need more than one attestation
• Train staff and internal auditors; conduct internal audits
• Prepare the client for certification, surveillance and SOC 2 examination
• Support GDPR and national data-protection-law alignment with the privacy team

• ISO/IEC 27001:2022 lead auditor certification
• Ten or more completed ISO/IEC 27001 consulting or audit projects
• Proven ISMS documentation and implementation, including risk assessment and producing the Statement of Applicability
• Able to run gap assessments and internal audits on site and online
• Familiarity with the information-security and data-protection laws of the markets you serve
• ISO/IEC 27701, SOC 2 or PCI DSS exposure an advantage
• Working knowledge of IT infrastructure, cloud and identity concepts sufficient to challenge an IT team constructively
• Ability to write clear security policy in plain English
• Flawless English, strong training delivery, degree in engineering, computer science or information systems

Complete the form with your name, e-mail, phone, the role you are applying for and your CV (PDF or Word). We acknowledge every application and contact shortlisted candidates for a first conversation.

Sterling uses the details and CV you submit only to assess your application and to contact you about it. They are seen by the people involved in recruitment and are kept for as long as the applicable law allows for recruitment records, then deleted. You can ask us to delete your application at any time. Our Privacy Policy explains your rights.