Information Security Consultant (6 months)

Location: Bengaluru, India (Hybrid)

Type: Full-time Consultant (6 months)

Department: Information Security

About Us

Qure.ai is a global healthtech company using artificial intelligence to improve disease detection and patient outcomes at scale. Our solutions are deployed across hospitals, diagnostic networks, and public health programs worldwide.

Today, our technology has impacted 40M+ lives across 105+ countries, deployed across 5,200+ sites, and powered by one of the world’s largest real-world medical imaging datasets. With 26 FDA-cleared indications, we are helping shape the future of AI-driven healthcare.

As a healthtech company working with hospitals and public health programs across 105+ countries, earning and keeping customer trust in how we protect data is central to everything we do. Our ISO 27001 certification and SOC 2 Type II report are how we prove it.

We are looking for an Information Security Consultant to own and mature our information security and compliance program. You will run our ISO 27001 ISMS and SOC 2 Type II audits, keep our controls healthy year-round, and be a trusted partner to engineering, IT and customer-facing teams.

• ISO 27001 ISMS: Maintain Qure’s ISMS end to end, including scope, Statement of Applicability, risk register, risk treatment plans and the full set of Annex A controls.
  
• SOC 2 Type II: Run the annual audit cycle, from control mapping and continuous evidence collection through auditor walkthroughs, sample requests and closure of exceptions.
  
• Audits: Plan and run internal audits, coordinate surveillance and recertification audits with external auditors, and drive corrective actions to closure on time.
  
• Policies & procedures: Own, review and update information security policies, standards and SOPs at least annually, and get them approved and acknowledged across teams.
  
• Risk management: Run periodic information security risk assessments, track risks with clear owners and due dates, and report status to leadership.
  
• Vendor security: Assess third-party and sub-processor risk through questionnaires, report reviews (SOC 2 / ISO certificates) and contract security clauses.
  
• Customer trust: Answer security questionnaires, RFP security sections and customer audit requests from hospitals, health systems and partners worldwide.
  
• Access & asset hygiene: Run quarterly user access reviews, maintain the asset inventory and track joiner–mover–leaver controls with IT and HR.
  
• Vulnerability management: Own the vulnerability management process end to end. Coordinate regular scans and annual third-party penetration tests, triage findings by severity, track remediation with Engineering and IT against agreed SLAs, and report on open and overdue vulnerabilities.
  
• Security awareness: Run onboarding and annual security and privacy training, phishing simulations and track completion across the company.
  
• Incident & continuity: Maintain the incident response, business continuity and disaster recovery plans, run tabletop exercises and support incident handling.
  
• Cross-functional partnership: Act as the security point of contact for IT, Engineering, DevOps, Product, HR and Legal. Help teams build controls into their daily work, review security impact of new features and tools, and make sure each control owner knows what is expected and when.
  
• Sprinto (compliance platform): Own and manage Sprinto as the system of record for ISO 27001 and SOC 2. Keep integrations, control mappings, policies and evidence up to date, assign and follow up on control tasks with owners, and use it to stay audit-ready year-round.
  
• Metrics & reporting: Track and report compliance health, open findings, risk posture and training completion to leadership and the security steering committee.
  

• Take full ownership of the ISMS and SOC 2 control set, with a clear view of every control, its owner and its evidence.
  
• Lead Qure through at least one ISO 27001 surveillance or recertification audit with no major non-conformities.
  
• Complete a SOC 2 Type II audit window with a clean opinion and exceptions (if any) closed with documented remediation.
  
• Refresh the risk register and complete at least one full risk assessment cycle with leadership sign-off.
  
• Move evidence collection to a continuous, mostly automated process so audit preparation no longer depends on last-minute effort.
  
• Cut turnaround time on customer security questionnaires through a maintained answer library and trust documentation.
  
• Achieve full completion of annual security awareness training and quarterly access reviews.
  

·

• 1–2 years of hands-on experience in information security, GRC or compliance.
  
• Direct experience implementing or maintaining an ISO 27001:2022 ISMS, including risk assessment, SoA and internal audits.
  
• Hands-on involvement in at least one SOC 2 Type II audit, ideally from readiness through report issuance.
  
• Working knowledge of security fundamentals, including access management, logging and monitoring, encryption, vulnerability management, change management and backup.
  
• Familiarity with cloud environments (AWS, Azure or GCP) and how common controls are evidenced there.
  
• Strong written communication; you can write a clear policy, a crisp audit response and a customer-ready security answer.
  
• Organised and detail-oriented, able to run many parallel workstreams and follow up with control owners across teams.
  
• Good to have: ISO 27001 Lead Implementer / Lead Auditor, CISA, CompTIA Security+ or similar certification.
  
• Good to have: exposure to healthcare and privacy frameworks such as HIPAA, GDPR, India’s DPDP Act or ISO 27701, and compliance automation tools (e.g. Vanta, Drata, Sprinto).
  

·Flexibility & Ownership

o Hybrid work culture

o Relocation support (where applicable)

o Opportunity to work on global markets

·Growth & Learning

o Learning and development allowance

o High ownership and accelerated career growth

·Wellbeing

o Comprehensive health insurance

o Free online doctor consultations

o Unlimited therapy sessions

o Fitness & wellness allowance

·Culture & Community

o Annual and team offsites

o Complimentary meals at the office

o Gaming zone (yes - including a PS5)

· Humble: Curious, open to feedback, and focused on team success over individual credit.

· Hungry: High ownership, relentless drive, and a constant push for better outcomes.

· Smart: Structured thinking with empathy, solving complex problems with clarity and strong collaboration.

Our inclusive workspace || Applicant Privacy Policy