About Us – Who We Are

ProductSquads was founded with a bold mission: to engineer capital efficiency through autonomous AI agents, exceptional engineering, and real-time decision intelligence.

We're building an AI-native platform that redefines how software teams deliver value — whether through code written by humans, agents, or both. Our technology stack combines agentic AI systems, ML pipelines, and high-performance engineering workflows.

This is your chance to build not just models, but systems that think, decide, and act — AI fabric tools, domain-intelligent agents, and real-time decision systems that power the next generation of product delivery.

The Role – What You'll Do

Role Purpose

Own trust assurance workflows from intake through decision and closure. The AI GRC Specialist delivers accurate customer security questionnaire responses, coordinates security contributions to RFPs, reviews security content in customer addendums, runs vendor risk assessments, maintains the company risk register, and leads at least one certification workstream.

The role uses AI to improve the complete GRC workflow, not simply to process more requests. It applies the time saved to risk analysis, vendor follow-through, and certification closure. The Specialist makes clear, business-focused recommendations and works with limited day-to-day supervision.

Role at a Glance

- Function: Governance, Risk and Compliance (GRC) / Security Assurance
- Level: Individual Contributor
- Experience: 8+ years of relevant experience
- Reports To: CISO or designated security leader
- Core Scope: Customer assurance, vendor risk, risk register, certification workstream, and AI-assisted GRC improvement

Responsibilities – Your Scope
- Customer and Sales Assurance

- Own security questionnaire delivery from intake to submission, including prioritization, customer follow-up, service levels, and answer quality.
- Coordinate security responses and evidence for RFPs owned by Sales or the business team. The Specialist does not own the overall RFP.
- Review and respond to security and risk provisions in customer addendums. Engage Legal for contractual terms outside the security scope.
- Maintain the security answer library and verify that standard answers reflect current controls and evidence.

2. Vendor Risk and Risk Register
- Run the vendor risk program, including tiering, due diligence, assessments, risk ratings, remediation tracking, and reassessment cadence.
- Lead assessments for high-risk vendors and coordinate evidence or action plans with relevant internal owners.
- Maintain the risk register in the company GRC platform by documenting risks, assigning owners, tracking treatment, and providing leadership with a current view of the organization's risk posture.

3.



Certifications and Control Assurance
- Own at least one certification workstream, such as SOC 2, ISO 42001, or TISAX, from gap assessment through auditor closure. Support other assurance activities as needed.
- Coordinate control owners, evidence collection, remediation, and audit follow-up while keeping status and dependencies visible.

4. AI-Assisted GRC Operations
- Improve workflows for questionnaire drafting, vendor document review, control mapping, and evidence reuse, with feedback loops that make subsequent cycles more accurate.
- Measure changes in manual effort and answer accuracy, and demonstrate how the capacity released is redirected to risk analysis and closure activities.
- Coach Analysts on quality, escalation, and identifying manual steps that can be simplified or automated.

What This Role Is Not
- A questionnaire-processing role measured by volume alone; accuracy, risk insight, and closure matter.
- The owner of end-to-end RFP delivery; the role provides security content and supporting evidence.
- A legal reviewer or the final decision-maker for accepting company risk.
- A security engineering role. Engineers build and enforce technical controls; this role verifies evidence, tracks gaps, and escalates issues where controls are not operating as expected.
- A gatekeeper that slows sales or procurement. The role balances timely responses with reliable, supportable answers.

Ownership – Decision Rights and Deliverables

Decision Rights

Decides / Owns

- Questionnaire workflow, answer-library maintenance, assessment execution, and risk-register quality.
- Vendor tiering and reassessment cadence within approved policy.
- GRC workflow improvements and quality checks within approved tools and policies.

Recommends / Coordinates

- Security response positions and remediation plans with control owners.
- Certification workstream priorities and closure plans.
- Use of AI-assisted drafting and review, with appropriate validation.

Escalates / Consults

- Risk acceptance to the designated business or risk owner.
- Contract language outside the security scope to Legal.
- Technical control design or implementation gaps to Security Engineering or relevant control owners.

Key Deliverables For Each Request

- Accurate, evidence-backed customer questionnaire or security contribution delivered within the agreed service level.





Ongoing

- Current vendor assessments, tiering, remediation actions, and reassessment dates, with active follow-up on high-risk vendors.
- A current risk register with documented ratings, accountable owners, treatment status, and a concise leadership risk-posture view.

At Certification Milestones

- A defined certification workstream with gap status, evidence owners, remediation tracking, and auditor actions tracked through closure.

Quarterly Review

- AI-assisted GRC workflow metrics covering effort, answer accuracy, cycle time, and how released capacity was utilized.

Requirements – What You'll Bring
- Bachelor's degree in Information Systems, Computer Science, Business, or a related field, or equivalent practical experience.
- At least 4 years of experience in GRC, security assurance, or vendor risk, including hands-on ownership of customer questionnaires and vendor assessments.
- Experience supporting SOC 2 and at least one of ISO 27001, ISO 42001, or TISAX.
- Demonstrated use of AI-assisted tools to reduce manual work while improving accuracy, with appropriate human review.
- Strong written and verbal communication skills, including the ability to explain risk and business impact to customers and senior stakeholders.

Nice to Have
- Experience administering a GRC platform such as Secureframe, Vanta, or Drata.
- Familiarity with AI governance frameworks and AI-specific vendor risk.
- CISA, CRISC, CISM, or ISO 27001 Lead Implementer certification. Relevant practical experience is also valued.

Leadership Competencies
- Risk Judgment: Separates control evidence, exposure, and business impact, and makes proportionate recommendations.
- Accuracy and Ownership: Checks source evidence, closes follow-ups, and keeps records current.
- Clear Communication: Writes concise, supportable responses and adapts the level of detail to the audience.
- Responsible AI Use: Validates generated content, protects sensitive information, and understands when human review or escalation is required.
- Continuous Improvement: Identifies recurring workflow challenges and measures whether changes improve both efficiency and quality.

How Success Is Measured Success is measured through service-level performance, response accuracy, timely completion of vendor assessments, a current and actionable risk register, certification milestones achieved, and reduced manual effort without weakening risk management.

Request volume alone is not a measure of success.

What We Offer

- Monday to Friday workweek with adaptable working hours
- Paid time off and holidays
- Medical insurance
- Professional development and training budget
- A dynamic, collaborative, ship-fast environment

📌 AI GRC Specialist (Hyderabad)
🏢 ProductSquads
📍 Hyderabad