You're a GRC engineer who reviews and builds. You bring a strong foundational understanding of core security concepts —identity boundaries, data flow mapping, least privilege — and you know how to apply them to assess the security and compliance of quick-moving systems.
Direct exposure to OAuth, non-human and agentic identities, and LLM data flows is a significant plus, but it's not a prerequisite. What matters more is a fierce appetite and the capability to quickly learn how these foundations translate to cutting-edge AI and agentic systems. You approach the work with an AI-first mindset: not just reviewing these systems, but using AI coding tools to stand up review and monitoring solutions far faster than any team could do manually.
About GRC Engineering At Razorpay
GRC at Razorpay is being re-founded as an engineering discipline. We are transforming a traditional compliance team into GRC Engineering applying software-engineering principles (automation, version control, continuous monitoring) to governance, risk, and compliance.
This is not about turning compliance professionals into software engineers. Traditional GRC expertise frameworks, control design, and audit judgement remains the foundation and the accountable core. GRC Engineering builds on it by making execution scalable and repeatable: policy-as-code, automated evidence collection, continuous controls monitoring, and AI workflows that do the mechanical work while a named human stays accountable for every decision. This role sits within the GRC Engineering uni one of two units, alongside Privacy, reporting into the Head of GRC & Privacy.
Razorpay operates under one of the densest regulatory stacks in Indian technology the DPDP Act 2023, RBI Payment Aggregator and Payment Gateway directions, PCI-DSS v4.0, ISO 27001/27701, and SOC 2 all at once. Doing this by hand does not scale to our velocity. Our approach is AI-native and pragmatic: AI handles the high-volume, repetitive work evidence col