Job Overview We are looking for an experienced Information Security & GRC Specialist to manage and strengthen the company's information security, governance, risk, and compliance programs. The candidate will be responsible for managing our security compliance activities through the Scrut.io platform and helping implement, monitor, and maintain controls required for SOC 2, HIPAA, GDPR, and PCI DSS v4.0.1. This role requires a combination of information security knowledge, technical understanding, risk management, and compliance experience. The ideal candidate should be comfortable working with Engineering, DevOps, IT, HR, and management teams to ensure that security controls are properly implemented, documented, monitored, and supported by appropriate evidence.

Key Responsibilities
1. Information Security & Compliance Management
• Manage day-to-day information security and compliance activities.
• Own and maintain the company's compliance program using the Scrut.io platform.
• Implement, monitor, and maintain controls required for SOC 2, HIPAA, GDPR, and PCI DSS v4.0.1.
• Monitor compliance status, identify control gaps, and coordinate remediation with relevant teams.
• Maintain compliance documentation, audit evidence, policies, procedures, and control records.
• Track compliance requirements, deadlines, and action items to ensure timely completion. 2. Audit & Evidence Management
• Coordinate internal and external security audits and assessments.
• Collect, review, validate, and maintain evidence for compliance requirements.
• Work with auditors and internal stakeholders to address audit observations and findings.
• Maintain audit readiness throughout the year rather than preparing only during audit periods.
• Manage customer security questionnaires, vendor assessments, and compliance-related requests. 3. Technical Security & Risk Management
• Work with Engineering and DevOps teams to review and validate technical security controls.
• Understand and assess security configurations across AWS infrastructure, Cloudflare, servers, databases, networks, and applications.
• Monitor vulnerability assessment and penetration testing (VAPT) findings and track remediation.
• Assist with security risk assessments, threat identification, and risk mitigation planning.
• Review access controls, user permissions, MFA,



encryption, logging, backups, patch management, and network security controls.
• Support secure software development practices, change management, and application security reviews.
• Help identify security weaknesses and recommend practical improvements. 4. PCI DSS Compliance
• Help maintain compliance with PCI DSS v4.0.1 requirements applicable to the company's environment.
• Maintain documentation and evidence for applicable PCI DSS controls.
• Coordinate with Engineering and DevOps teams on payment-page security, script authorization, integrity monitoring, and change/tamper detection requirements.
• Track PCI DSS findings and ensure remediation activities are completed.
• Maintain PCI DSS scope documentation, responsibility matrices, and supporting procedures. 5. Privacy & Data Protection
• Support GDPR and HIPAA compliance activities.
• Help maintain data protection and privacy policies and procedures.
• Assist with data inventory, data flow documentation, privacy risk assessments, and data handling reviews.
• Support privacy-by-design practices and ensure appropriate safeguards are considered when new features or systems are introduced.
• Help manage data retention, access, deletion, and protection requirements. 6. Security Policies & Awareness
• Develop, review, and maintain information security policies, standards, and procedures.
• Ensure policies are communicated and followed across the organization.
• Coordinate security awareness training and track employee completion.
• Support employee onboarding and offboarding security processes.
• Help maintain incident response procedures and coordinate security incident documentation and follow-up activities. 7. Vendor & Third-Party Risk Management
• Conduct security assessments of vendors and third-party service providers.
• Review vendor security documentation, certifications, and compliance reports.




• Maintain vendor risk records and track identified risks and remediation actions.
• Support business continuity, disaster recovery, backup, and incident response assessments. Required Skills & Qualifications
• 5–8 years of experience in Information Security, Governance, Risk & Compliance (GRC), or a related role.
• Practical experience with SOC 2, HIPAA, GDPR, and/or PCI DSS compliance.
• Hands-on experience using GRC or compliance automation platforms such as Scrut.io, Vanta, Drata, or similar tools.
• Positive understanding of information security principles, risk management, and security controls.
• Understanding of AWS security, cloud infrastructure, network security, and application security.
• Knowledge of vulnerability management, penetration testing, access management, encryption, MFA, and incident management.
• Experience preparing security policies, procedures, risk assessments, audit evidence, and compliance documentation.
• Ability to understand technical security requirements and work effectively with Engineering and DevOps teams.
• Strong analytical, documentation, communication, and coordination skills.
• Ability to independently manage compliance activities and drive closure of identified gaps. Good to Have
• ISO 27001 implementation or audit experience.
• Experience with AWS security services and infrastructure controls.
• Familiarity with Cloudflare security features and configurations.
• Experience with Qualys, Nessus, or other vulnerability assessment tools.
• Knowledge of secure SDLC and application security testing.
• Experience supporting PCI DSS v4.0.1 requirements 6.4.3 and 11.6.1.
• Relevant certifications such as CISA, CISM, CISSP, ISO 27001 Lead Implementer/Auditor, Security+, or similar. Candidate Profile We are looking for someone who can take ownership of the company's information security and compliance program. The candidate should not be limited to preparing policies and collecting audit documents. They should be capable of understanding technical security controls, identifying gaps, coordinating with technical teams, and ensuring that compliance requirements are implemented effectively. The ideal candidate will combine practical technical security knowledge with strong GRC and compliance management skills.

📌 Information Security (India)
🏢 SalesVu
📍 India