Information Security Consultant (6 months)

Role overview

Information Security Consultant (6 months) at Qure.ai

Required qualifications

• 1–2 years Type: Full-time Consultant (6 months) Department: Information Security About Us Qure.ai is a global healthtech company using artificial intelligence to improve disease detection and patient outcomes at scale.
• Our solutions are deployed across hospitals, diagnostic networks, and public health programs worldwide.
• Today, our technology has impacted 40M+ lives across 105+ countries, deployed across 5,200+ sites, and powered by one of the world’s largest real-world medical imaging datasets.
• With 26 FDA-cleared indications, we are helping shape the future of AI-driven healthcare.
• The Opportunity As a healthtech company working with hospitals and public health programs across 105+ countries, earning and keeping customer trust in how we protect data is central to everything we do.
• Our ISO 27001 certification and SOC 2 Type II report are how we prove it.
• We are looking for an Information Security Consultant to own and mature our information security and compliance program.
• You will run our ISO 27001 ISMS and SOC 2 Type II audits, keep our controls healthy year-round, and be a trusted partner to engineering, IT and customer-facing teams.
• What You’ll Own & Drive ISO 27001 ISMS: Maintain Qure’s ISMS end to end, including scope, Statement of Applicability, risk register, risk treatment plans and the full set of Annex A controls.
• SOC 2 Type II: Run the annual audit cycle, from control mapping and continuous evidence collection through auditor walkthroughs, sample requests and closure of exceptions.
• Audits: Plan and run internal audits, coordinate surveillance and recertification audits with external auditors, and drive corrective actions to closure on time.
• Policies & procedures: Own, review and update information security policies, standards and SOPs at least annually, and get them approved and acknowledged across teams.
• Risk management: Run periodic information security risk assessments, track risks with clear owners and due dates, and report status to leadership.
• Vendor security: Assess third-party and sub-processor risk through questionnaires, report reviews (SOC 2 / ISO certificates) and contract security clauses.
• Customer trust: Answer security questionnaires, RFP security sections and customer audit requests from hospitals, health systems and partners worldwide.
• Access & asset hygiene: Run quarterly user access reviews, maintain the asset inventory and track joiner–mover–leaver controls with IT and HR.
• Vulnerability management: Own the vulnerability management process end to end.
• Coordinate regular scans and annual third-party penetration tests, triage findings by severity, track remediation with Engineering and IT against agreed SLAs, and report on open and overdue vulnerabilities.
• Security awareness: Run onboarding and annual security and privacy training, phishing simulations and track completion across the company.
• Incident & continuity: Maintain the incident response, business continuity and disaster recovery plans, run tabletop exercises and support incident handling.
• Cross-functional partnership: Act as the security point of contact for IT, Engineering, DevOps, Product, HR and Legal.
• Help teams build controls into their daily work, review security impact of new features and tools, and make sure each control owner knows what is expected and when.
• Sprinto (compliance platform): Own and manage Sprinto as the system of record for ISO 27001 and SOC 2.
• Keep integrations, control mappings, policies and evidence up to date, assign and follow up on control tasks with owners, and use it to stay audit-ready year-round.
• Metrics & reporting: Track and report compliance health, open findings, risk posture and training completion to leadership and the security steering committee.
• What Success Looks Like In the first 6–12 months, you will: Take full ownership of the ISMS and SOC 2 control set, with a clear view of every control, its owner and its evidence.
• Lead Qure through at least one ISO 27001 surveillance or recertification audit with no major non-conformities.
• Complete a SOC 2 Type II audit window with a clean opinion and exceptions (if any) closed with documented remediation.
• Refresh the risk register and complete at least one full risk assessment cycle with leadership sign-off.
• Move evidence collection to a continuous, mostly automated process so audit preparation no longer depends on last-minute effort.
• Cut turnaround time on customer security questionnaires through a maintained answer library and trust documentation.
• Achieve full completion of annual security awareness training and quarterly access reviews.
• Core Skills Required 1–2 years of hands-on experience in information security, GRC or compliance.
• Direct experience implementing or maintaining an ISO 27001:2022 ISMS, including risk assessment, SoA and internal audits.
• Hands-on involvement in at least one SOC 2 Type II audit, ideally from readiness through report issuance.
• Working knowledge of security fundamentals, including access management, logging and monitoring, encryption, vulnerability management, change management and backup.
• Familiarity with cloud environments (AWS, Azure or GCP) and how common controls are evidenced there.
• Strong written communication; you can write a clear policy, a crisp audit response and a customer-ready security answer.
• Organised and detail-oriented, able to run many parallel workstreams and follow up with control owners across teams.

Preferred qualifications and skills

• ISO 27001 Lead Implementer / Lead Auditor, CISA, CompTIA Security+ or similar certification.
• exposure to healthcare and privacy frameworks such as HIPAA, GDPR, India’s DPDP Act or ISO 27701, and compliance automation tools (e.g. Vanta, Drata, Sprinto).
• Life at Qure
• Flexibility & Ownership o Hybrid work culture o Relocation support (where applicable) o Opportunity to work on global markets
• Growth & Learning o Learning and development allowance o High ownership and accelerated career growth
• Wellbeing o Comprehensive health insurance o Free online doctor consultations o Unlimited therapy sessions o Fitness & wellness allowance
• Culture & Community o Annual and team offsites o Complimentary meals at the office o Gaming zone (yes - including a PS5) Our Values
• Humble: Curious, open to feedback, and focused on team success over individual credit.
• Hungry: High ownership, relentless drive, and a constant push for better outcomes.
• Smart: Structured thinking with empathy, solving complex problems with clarity and strong collaboration.
• Our inclusive workspace || Applicant Privacy Policy

Employment details

• Location: Bengaluru, India (Hybrid)
• Location: Bangalore North [Karnataka] [India]