1. Key responsibilities

1.1 Practice leadership and P&L

• Own the practice profit and loss: revenue, gross margin, utilisation and cost of delivery, against annual targets agreed with the CISO and CTO.
• Prepare the annual practice plan and budget: services, headcount, tools, training and partner capacity.
• Set pricing and effort-estimation standards for each service line, and approve proposal pricing within delegated limits.
• Lead business development with the sales team: client meetings, scoping calls, proposals, presentations and renewals.
• Report monthly to the CISO and CTO on pipeline, delivery status, margin, risks and quality

1.2 CERT-In audits and VAPT

• Lead the delivery of CERT-In audits and VAPT (web, mobile, API, network, cloud and configuration reviews), in line with CERT-In’s audit guidelines and directions.
• Plan, scope and staff each audit, using only J&S employees declared to CERT-In.
• Make sure reports meet CERT-In’s reporting, sign-off and submission requirements, ready for the CISO’s authorisation as head of the auditing organisation.
• Present scope and findings to client leadership, and run follow-up audits through to closure.

1.3 CREST accreditation and CREST-aligned services

• Lead J&S from CREST Pathway+ to full CREST accreditation.
• Build CREST-aligned methods for penetration testing, vulnerability assessment and incident response.
• Develop team members towards CREST individual qualifications.

1.4 Global framework readiness and implementation

• Lead readiness and implementation engagements for ISO/IEC 27001, ISO/IEC 27701, ISO 9001, ISO/IEC 20000-1, NIST CSF, SOC 2, PCI DSS, the DPDP Act, 2023 (India), Cyber Essentials (UK) and Essential Eight (Australia).
• Oversee gap assessments, risk assessments, policy sets, internal audits and management review support.
• Prepare clients for external audit. The client engages an independent certification body accredited under the Global ACI MRA (formerly the IAF MLA). neXavault does not certify.

1.5 Independence, quality and risk

• Make sure the team that implements a client’s controls never audits the same client, and run conflict-of-interest checks before accepting work.
• Own the practice quality system: methods, peer review and report quality gates.
• Make sure client and audit data is handled securely, in line with CERT-In’s data-handling guidelines and client contracts.
• Keep the practice risk register, and escalate independence concerns to the CISO.

1.6 Empanelments and accreditations

• Keep J&S’s CERT-In empanelment and CREST Pathway+ status in good standing, including staff records and renewals.
• Keep a register of team qualifications and training, and close skill gaps.
• Support the CISO on J&S’s internal ISMS.

1.7 People and partners

• Hire, lead and develop the team.
• Plan resourcing across in-house staff and associate partners (partners are not used on CERT-In audits).
• Build a culture of ethical, careful and well-documented work.

2. Qualifications and experience

2.1 Essential

• 8-12 years in cyber security, including at least 3 years leading audit, testing or GRC teams.
• Hands-on experience delivering CERT-In audits and VAPT engagements.
• ISO/IEC 27001 Lead Auditor certification (a qualification CERT-In records for declared audit staff).
•  Working knowledge of ISO/IEC 27001, NIST CSF, the DPDP Act, 2023, and at least one other framework listed in section 3.4.
• Proven experience managing a budget, pricing work or contributing to business development.
• Excellent report writing and client presentation skills in English.
• A bachelor’s degree in Computer Science, IT, Engineering or a related field.

2.2 Desirable

• One or more of: CISSP, CISA, DISA (ICAI), CISM.
• One or more offensive-security qualifications, such as OSCP or a CREST individual qualification.
• Experience taking an organisation through CREST accreditation, or working in a CERT-In empanelled auditing organisation.
• Exposure to UK, Australian or Gulf client work.
• Knowledge of ISO/IEC 27701, ISO 9001 or ISO/IEC 20000-1.

3. Skills and behaviours

• Commercial judgement: prices work correctly, protects margin and spots growth opportunities.
• Technical credibility: can review a penetration test finding and a control design with equal confidence.
• Integrity: applies independence and ethics rules even under client or commercial pressure.
• Leadership: builds, coaches and holds a team to high standards.
• Clear communication: explains technical risk in plain language to senior client stakeholders.
• Organisation: runs several engagements at once without losing quality.

4. What we offer

•  A competitive salary with a performance bonus linked to practice results.
• Sponsorship of relevant professional certifications.
• An annual learning and conference budget.
• The chance to build and lead a growing cyber assurance practice.

5. Equal opportunity

John & Smith is an equal-opportunity employer. We welcome applications from all qualified candidates, whatever their gender, age, religion, caste, disability, sexual orientation or background.

How to apply: send your CV and a short cover note to careers@johnandsmithglobal.com, with the subject line “Head of Cyber Assurance & Operations”.

neXavault - The Cyber Armour - is the cybersecurity, risk and compliance practice of John & Smith, helping organisations secure their operations and meet the frameworks, standards and regulations that matter to their business.

Contact

audits@johnandsmith.co.in · +91 62820 07077 · www.johnandsmithglobal.com
Principal office: Amenity Block, Lulu IT Twin Towers, SmartCity SEZ, Kakkanad, Kochi, Kerala 682042, India

Offices: India · UAE · UK