About the Role

R360 maintains concurrent conformance to six major compliance frameworks ISO/IEC 27001:2022, ISO/IEC 27701, ISO/IEC 20000-1, SOC 2, India's DPDP Act 2023, and PCI DSS v4.0.1 across a banking-linked platform serving HDFC Bank, ICICI Bank, and Kotak Mahindra Bank. This paid internship gives you structured, mentored exposure to real audit cycles, evidence collection, and control-testing work across all six frameworks a depth of multi-framework exposure that is uncommon at entry level, under the direct supervision of senior GRC analysts.

Key Responsibilities (Under Supervision)

- Assist in evidence collection for ISO 27001, ISO 27701, ISO 20000-1, SOC 2, PCI DSS, and DPDP Act compliance activities.

- Support risk register updates and control-testing sample pulls.

- Assist with policy and procedure documentation reviews and version control.

- Support first-draft responses to vendor/client security questionnaires, reviewed by a senior GRC analyst before submission.

- Assist with audit logistics scheduling, evidence repository organisation, and auditor request tracking.

- Learn ROPA and DPIA basics under supervision as part of DPDP Act 2023 compliance work.

- Support security awareness training tracking and completion reporting.

- Assist with PCCB documentation review to flag compliance-relevant changes.

Learning Outcomes

- Real-world exposure to six concurrent compliance frameworks inside a live BFSI-adjacent environment.

- Understanding of the full audit lifecycle preparation, evidence collection,



auditor coordination, and closure.

- Foundational GRC skills that map directly to a GRC Analyst career path.

Eligibility

- Pursuing or recently completed a degree in Information Security, IT, Law, Business Administration, or a related field.

- Basic understanding of information security and/or data privacy concepts; relevant coursework or in-progress certifications are a plus.

- Detail-oriented with solid written English for documentation-heavy work.

- GRC — Governance, Risk & Compliance Hiring

- Genuine interest in a compliance/audit career path (as distinct from a purely technical/offensive-security track).

Preferred (Not Mandatory)

- ISO/IEC 27001 Foundation certificate, or actively pursuing one.

- Exposure to privacy law coursework (DPDP Act 2023, GDPR) is a plus.

- Comfort with Excel/Google Sheets and, ideally, some exposure to a GRC tool (ServiceNow GRC, OneTrust, Vanta, or similar).

Program Structure

1. Month 1–2 Foundations

Framework overview across ISO 27001, ISO 27701, ISO 20000-1, SOC 2, PCI DSS, and DPDP Act 2023; shadowing GRC analysts; tool walk throughs.

1. Month 3–4 Guided Evidence Collection

Hands-on evidence collection and control-testing support, with mandatory senior review before submission.

1. Month 5–6 Supervised Independence

Independent ownership of low-risk documentation/evidence tasks (reviewed); capstone project — build one control-mapping matrix or mini gap-analysis across two frameworks.

📌 GRC Intern (Bengaluru)
🏢 Reward360 Global Services Private
📍 Bengaluru