About EquityList:

EquityList is trusted by 600 companies to manage their cap table and stock option workflows and compliance. Our comprehensive platform allows customers to manage and administer equity grants - ESOPs, SARs, RSUs, RSAs seamlessly and at scale.

Our customers span APAC, MENA, and the US, including Tata Consumer Products, Taco Bell, Blackbuck, Livspace, Slice, smallcase, Tabby.ai, and Shiprocket - managing equity for 50,000 stakeholders and stock options worth $3Bn . We're backed by AngelList India, Hustle Fund, Republic, Unpopular Ventures, Mana Ventures, and a stellar group of angels.

About the Role:

As we deepen our enterprise footprint across regulated markets - onboarding listed companies, fintechs, and compliance-driven clients across three geographies, security has moved from a checkbox to a core trust signal. Clients managing billions in equity on our platform expect us to meet enterprise-grade security standards, and we take that seriously. We're looking for an Information Security Associate who is hands-on, ownership-oriented, and equally comfortable hardening infrastructure and walking a client's CISO through our controls framework.

You'll be our first dedicated security hire - which means you own the function, set the baseline, and ensure every enterprise prospect can trust EquityList with their most sensitive equity data.

Ideal Candidate Mindset:

You've been the only security person in a room full of engineers. You've written the first acceptable use policy and found a critical IDOR on the same day. You care about building systems and processes that outlast you, not just passing audits.

Key Responsibilities:

1.

Security

Operations:

- Own our day-to-day security posture, access controls, endpoint hardening, secrets management, and cloud security hygiene on GCP. Monitor SIEM alerts, investigate incidents,



and lead post-incident reviews with written closure reports.

2.

Vulnerability

Management:

- Conduct periodic internal assessments and coordinate third-party VAPT engagements. Own the remediation tracker and ensure findings don't die in a spreadsheet.

3. Compliance & ISMS:

- Build and maintain our Information Security Management System - policies, risk registers, vendor assessments, and runbooks. Be the person who actually keeps these updated.

4.

Certification Readiness:

- Support readiness for ISO 27001, SOC 2 Type II, and GDPR (EU) - maintaining evidence artefacts, coordinating with auditors, and closing gaps proactively.

5. Client-Facing Trust Building:

- Own our Infosec response library for enterprise RFPs, DDQs, and security annexures.

Represent

EquityList on client InfoSec calls with clarity and confidence.

6. Product and Application Security:

- Work with the engineering team on secure design reviews, threat modelling, and pre-release security checks - bringing security into the SDLC, not just after the fact.

7. Bug Bounty/Responsible disclosure programs:

- Take ownership of initiating and managing bug bounty programs.

8. Cross-functional Collaboration:

- Partner with Product, Compliance, and Business teams to translate security requirements into practical, executable controls without becoming a blocker.

Requirements:

Technical:

- 2 - 3 years in an InfoSec, security engineering, or GRC technical hybrid role. Ideally,



at a SaaS or fintech company.
- Working knowledge of GCP security - IAM, VPC service controls, Cloud Armor, Security Command Center, Cloud Logging, and alerting.
- Familiarity with OWASP Top 10, common vulnerability classes, and the ability to triage scanner output.
- Experience writing security policies, ISMS documentation, and risk registers - not just reading templates.
- Scripting ability (Python or Bash) for automating checks or log analysis is a plus.

Soft Skills:

- Strong written communication, you can translate technical risk into plain language for a founder, a CFO, or a client's legal team.
- Documentation-first mindset, you close loops and keep records clean without being reminded.
- Startup-ready, comfortable with ambiguity, proactive about gaps, and able to wear multiple hats.

Education:

- B.E. / B.Tech in Computer Science, IT, or related field - or equivalent practical experience.
- CompTIA Security , CEH, or Google's Qualified Cloud Security Engineer certification is a plus.

Good to Have:

- Hands-on involvement in ISO 27001 implementation or audit support.
- SOC 2 Type II readiness experience.
- VAPT coordination with third-party vendors.
- Awareness of India's DPDP Act and IT Act obligations.
- Prior experience at a B2B SaaS or fintech startup.
- Hands-on experience with DLP, MDM, or SIEM tooling.
- Build from scratch: You're EquityList's first security hire, you write the playbook, choose the tools, and define what security culture looks like here. No bureaucracy, full ownership.
- Work at the intersection of security and growth: At our stage, security directly enables revenue. You'll co-own enterprise onboarding conversations, influence product architecture, and build relationships with CISOs and CFOs at India's fastest-growing companies.

📌 E-List Technologies - Information Security Associate - Vulnerability Management (India)
🏢 EquityList
📍 India