Information Security Associate
athenahealth
Information Security Associate
About this role
JOB SUMMARY
The Information Security Associate will take ownership of day-to-day operation, maintenance, and continual
improvement of the organization's Information Security Management System (ISMS) in accordance with ISO/IEC
27001:2022. Building on hands-on experience gained during the ISO 27001 certification/renewal cycle, this role
independently drives governance, risk management, and compliance (GRC) activities, coordinates internal and
external audits, manages vulnerability and incident processes, and leads security awareness initiatives, while acting
as a key point of contact for cross-functional security and compliance matters.
KEY RESPONSIBILITIES
ISMS Governance & Compliance
- Own the day-to-day operation, documentation, and continual improvement of the ISMS in line with ISO/IEC 27001:2022.
- Assist the maintenance and periodic review of the Statement of Applicability (SoA), risk register, asset inventory, and
related ISMS records.
- Independently conduct information security risk assessments and drive risk treatment planning through to closure.
- Serve as a primary coordinator for surveillance audits, recertification audits, and internal audits, including audit planning,
evidence collection, and liaison with auditors.
- Track non-conformities and corrective actions to resolution, and report compliance status to the Information Security
Officer.
Policy & Documentation
- Own the drafting, review, and version control of information security policies, procedures, standards, and guidelines.
- Ensure documentation stays aligned with ISO/IEC 27001:2022, applicable regulatory requirements, and industry best
practices.
- Support policy rollout and acknowledgement tracking across departments.
Incident & Vulnerability Management
- Manage the security incident register end-to-end: logging, triage, investigation support, and closure documentation.
- Assist vulnerability management activities, including scan coordination, tracking, prioritization, and follow-up with
system/application owners through remediation.
- Monitor Wazuh security alerts and endpoint events, and escalate relevant findings to the Information Security Officer and
IT/Infrastructure team for investigation and remediation.
- Contribute to Vulnerability Assessment and Penetration Testing (VAPT) planning, scoping, and remediation verification.
- Escalate high-risk findings and incidents to the Information Security Officer in a timely manner.
Security Awareness & Training
- Plan and run information security awareness programs, training sessions, and phishing simulation campaigns.
- Analyze awareness and phishing simulation results and recommend targeted improvements.
Reporting & Continuous Improvement
- Prepare and present security metrics, compliance dashboards, and management reports to leadership.
- Prepare weekly/monthly departmental information security reports covering security alerts, incidents, vulnerabilities,
compliance activities, and security awareness metrics.
- Research emerging cybersecurity threats, regulatory changes, and security frameworks, and recommend improvements
to the ISMS.
- Identify opportunities to streamline GRC processes and documentation workflows.
Cross-Functional Collaboration
- Act as a key liaison with IT, Engineering, HR, and other departments on security and compliance initiatives.
- Support onboarding/offboarding, vendor risk reviews, and third-party due diligence from a security perspective.
- Mentor and guide future information security interns.
- Perform other information security-related tasks as assigned by the Information Security Officer.
QUALIFICATIONS AND SKILLS
Preferred Qualifications
- Bachelor's degree in Information Security, Cybersecurity, Computer Science, Information Technology, or a related field.
- Demonstrated hands-on experience supporting an ISO/IEC 27001:2022 ISMS (e.g., through an internship, certification
cycle, or equivalent project experience).
- Solid understanding of information security principles, cybersecurity concepts, and risk management methodologies.
- Working knowledge of ISO/IEC 27001, NIST Cybersecurity Framework, CIS Controls, or similar standards.
- A relevant certification (e.g., ISO 27001 Internal Auditor/Lead Implementer, Security+, or similar) is an advantage.
Key Skills
- Strong written and verbal communication, documentation, organizational, and audit-coordination skills.
- Strong analytical thinking, problem-solving, and risk-assessment abilities with high attention to detail.
- Proficiency in Microsoft Office, Jira/Confluence, and familiarity with GRC platforms or SIEM tools (such as Wazuh).
- Ability to work independently, take ownership of deliverables, and collaborate across teams.
Frequently Asked Questions
Is the salary disclosed for the Information Security Associate position at techkraftinc?
The salary for this Information Security Associate role at techkraftinc is not publicly listed. Click "Apply Now" to learn more about the compensation package on their official careers page.
Where is the Information Security Associate position at techkraftinc located?
This Information Security Associate role at techkraftinc is based in Kathmandu, Nepal. The position is listed as on-site or hybrid. Check the full job description or apply directly to confirm the work arrangement.
Is the Information Security Associate role at techkraftinc full-time or part-time?
This is listed as a Full time position. It is posted as a Information Security Associate role at techkraftinc.
How do I apply for the Information Security Associate position at techkraftinc?
Click the "Apply Now" button on this page. You will be redirected to techkraftinc's official application portal hosted on zohorecruit where you can submit your application directly.
When was the Information Security Associate job at techkraftinc posted?
This Information Security Associate position at techkraftinc was posted on Sep 30, 2026. Apply as soon as possible — early applications are often reviewed first.
Information Security Associate
techkraftinc
You'll be redirected to techkraftinc's official application page on zohorecruit.