- Lead ISO/IEC 27001:2022 engagements end to end: scoping, context and risk assessment, Statement of Applicability, policies and procedures, internal audit, management review, and Stage 1 and Stage 2 certification audit support.
- Lead SOC 2 readiness and attestation programmes: scoping against the Trust Services Criteria, control design, evidence planning, readiness assessment, and coordination with the CPA firm through Type I and Type II audits.
- Deliver DPDP Act 2023 and DPDP Rules 2025 advisory: personal data discovery and mapping, gap assessment, consent and notice review, data principal rights workflows, breach response planning, and recommendations on privacy governance.
- Conduct internal audits and gap assessments against ISO 27001 and related standards, and write clear audit reports, gap registers and nonconformity trackers.
- Run combined and multi-framework engagements so evidence is collected once and mapped across ISO 27001, SOC 2 and DPDP.

Client management

- Act as the primary point of contact for assigned clients, from kickoff to closure.
- Plan and track project timelines, run weekly status reviews, and manage scope and expectations with client stakeholders, including CXOs.
- Present findings and recommendations to client leadership in plain business language.
- Spot follow-on needs (VAPT, vCISO, AI governance, surveillance audits) and pass them to the sales team.

Team and practice

- Guide and review the work of junior consultants and interns, and act as the quality check on deliverables before they go to clients.




- Use and give feedback on SecComply's GRC platform to improve automation of evidence and controls.
- Contribute to templates, methodologies and pre-sales inputs such as scoping notes and effort estimates for proposals.
- Stay current on regulatory change in India and abroad, and share updates with the team.

Must-have experience and skills• 3 to 4 years of hands-on GRC experience in a small or mid-sized cybersecurity or compliance consulting firm (not only in-house roles).
- Has delivered at least two ISO 27001 implementations or certification readiness projects that reached a successful external audit.
- Practical exposure to SOC 2 readiness or audit support, including evidence collection and auditor coordination.
- Working knowledge of the DPDP Act 2023 and DPDP Rules 2025, with experience in at least one privacy or data protection assessment.
- Strong understanding of risk assessment methods, control frameworks and audit evidence standards.
- Excellent written English: able to produce client-ready policies, reports and emails with minimal review.
- Confident spoken communication with client teams and senior stakeholders.
- Ability to manage three to five client engagements in parallel and meet deadlines.
- Bachelor's degree in Computer Science, IT, Engineering or a related field.





Good to have• ISO 27001 Lead Auditor or Lead Implementer certification.
- Privacy certifications such as CIPP/E, CIPM, CDPSE or DCPP.
- CISA, CISM or similar audit and governance credentials.
- Exposure to ISO/IEC 27701, ISO/IEC 42001 (AI management systems), HIPAA, GDPR or UAE PDPL.
- Familiarity with cloud environments (AWS, Azure, GCP) and how their controls map to compliance requirements.
- Experience using GRC or compliance automation platforms.
- Prior experience mentoring juniors or leading a small delivery team.

Why join SecComply• Own client programmes end to end, with a explicit path to practice leadership as the GRC team grows.
- Work across a wide client mix: SaaS and AI startups, fintech, healthcare, manufacturing and IT services, in India, the UAE and the US.
- Build depth beyond ISO 27001 and SOC 2 into DPDP, AI governance and AI security, areas where demand is rising fast.
- Work directly with SecComply's leadership, including a former Fortune 500 CISO.
- See how compliance automation changes delivery, using our own GRC platform on live engagements.

Selection process and how to apply1. Resume screening
- Written assessment: a short gap analysis exercise based on a sample client scenario
- Technical discussion covering ISO 27001, SOC 2 and DPDP delivery experience
- Leadership round To apply, email your resume to [email protected] with the subject line "Compliance Lead: - ". Please include a short note on two engagements you led and the frameworks involved.

📌 GRC Lead (Bengaluru)
🏢 Seccomply
📍 Bengaluru