We’re Hiring | Senior Manager – Information Security & Compliance

Location: Pune, India | Work from Office

Working Hours: US Business Hours

Company: Orvera AI

1. About Orvera

Orvera is a conversational AI voice platform that automates inbound and outbound customer calls for enterprises, primarily in the United States. Our AI agents hold live conversations, integrate with customer systems of record, and process voice recordings, transcripts and customer data on behalf of our clients — including clients in regulated sectors such as US healthcare.

Enterprise buyers evaluate us on security and trust as much as on product capability. We hold a SOC 2 attestation and face a rising volume of security questionnaires, due-diligence reviews and contractual security obligations. This is our first dedicated security role, and a chance to build the function from the ground up.

2. Role Purpose The Senior Manager – Information Security & Compliance will own the day-to-day security and compliance program at Orvera and build it into a scalable function. The role is hands-on and delivery-focused, working closely with the CTO and engineering team and supported by a Security Steering Group for strategic and risk-acceptance decisions. The role has three dimensions:

- Builder: design and implement security controls, policies, processes and tooling — largely from first principles, not by maintaining an existing program.
- Trust enabler: remove security as a blocker in enterprise sales by owning customer security reviews, audits and assurance evidence.
- Risk manager: identify, prioritise and drive reduction of risk across cloud, application, AI, data, people and third parties, and run incident response when incidents occur.

3. Key Responsibilities 3.1 Security Program and Governance

- Develop and execute the information security roadmap, and recommend priorities and budget to the Security Steering Group.
- Write, maintain and drive adoption of the information security policy framework, standards and procedures across engineering, operations and corporate functions.
- Prepare monthly security posture, risk and KPI reporting for the Steering Group and leadership.

3.2 Compliance, Audit and Assurance

- Own SOC 2 Type II end to end: scoping, readiness, control design, evidence collection, auditor coordination, exception remediation and bridge letters.
- Lead PCI DSS scoping and compliance for any product flows involving payment card data, with an emphasis on scope reduction (tokenisation, DTMF masking, redaction).
- Map controls across frameworks (SOC 2, PCI DSS, ISO/IEC 27001, HIPAA Security Rule, GDPR, CCPA/CPRA) to avoid duplicated effort; assess ISO/IEC 42001 and NIST AI RMF alignment.
- Implement and administer compliance automation tooling (e.g. Vanta, Drata, Secureframe or equivalent).
- Support Legal on the security content of MSAs, DPAs, BAAs and customer security exhibits, including breach notification timelines and audit rights.

3.3 Customer Security Reviews and Trust

- Own the full lifecycle of customer security questionnaires (SIG, CAIQ, custom enterprise questionnaires),



RFP security sections and due-diligence calls.
- Build a reusable answer library, standard security pack and trust center to reduce turnaround time and sales-cycle friction.
- Represent Orvera in technical security discussions with enterprise customer security and procurement teams in the US and EU.
- Track and report review volumes, turnaround times and deal impact.

3.4 Risk Management

- Maintain the information security risk register and risk assessment methodology; present risk treatment and acceptance recommendations to the Steering Group.
- Conduct risk assessments across products, infrastructure, data flows and business processes; track treatment plans with accountable owners.
- Maintain data classification and data flow mapping for PII, PHI, payment data, voice recordings and transcripts.

3.5 Cloud, Infrastructure and Application Security

- Work with the CTO and engineering to secure the cloud environment: IAM, network segmentation, encryption and key management, logging and monitoring.
- Embed a secure SDLC: threat modelling, secure code review, SAST/DAST/SCA, secrets management, infrastructure-as-code scanning and container security.
- Run vulnerability management and annual third-party penetration testing, including remediation tracking and customer-shareable summaries.
- Verify multi-tenant isolation and customer data segregation controls.

3.6 AI and Conversational Platform Security

- Define and implement controls for LLM-based voice agents: prompt injection and jailbreak resistance, tool/function-call authorisation, output guardrails and abuse monitoring (OWASP Top 10 for LLM Applications).
- Assess third-party AI model vendors: zero data retention and no-training commitments, data residency, PII/PHI redaction before inference, and model/vendor change management.
- Address voice-specific risks including caller impersonation, synthetic voice and social engineering, and secure handling of recordings and transcripts.

3.7 Incident Response and Resilience

- Maintain the incident response plan and run incident response: detection, containment, investigation, root cause and lessons learned, escalating to the Steering Group and Legal for notification decisions.
- Run tabletop exercises at least annually, including AI-specific and data leakage scenarios.
- Support business continuity and disaster recovery planning and testing with Engineering.

3.8 Vendor and Third-Party Risk

- Operate a risk-tiered third-party risk management process covering cloud, LLM, speech-to-text, telephony/CPaaS and other sub-processors.
- Review vendor SOC reports (including complementary user entity controls), questionnaires and contractual protections; maintain the sub-processor register.

3.9 Security Operations,



Awareness and Partners

- Manage security monitoring (SIEM, EDR, cloud security posture management) through a managed detection and response (MDR) provider, plus access reviews and identity lifecycle controls.
- Run security awareness, phishing simulation and role-based training.
- Manage external partners — MDR provider, penetration testers and auditors — and help hire future team members.

4. Required Experience

- 8+ years of progressive information security experience, including at least 3 years at a startup or growth-stage SaaS / technology product company (ideally 100–200 employees).
- Demonstrable experience building security controls, policies and processes from the ground up — not solely operating within a mature enterprise program.
- Personal ownership of at least one SOC 2 Type II audit cycle end to end (two or more preferred), including auditor coordination and exception remediation.
- Hands-on experience with PCI DSS scoping, assessments or compliance (SAQ or ROC).
- Direct experience handling enterprise customer security questionnaires and due-diligence reviews for US and/or EU customers.
- Practical experience in risk management, incident response, third-party risk, cloud security and application security in a SaaS environment.
- Experience working closely with engineering teams, with enough technical depth to review architecture and cloud configurations.

5. Preferred Certifications

Certifications support but do not substitute for demonstrated hands-on, build-from-scratch experience.

- Security management: CISSP or CISM (one strongly preferred).
- Audit and risk: CISA, CRISC, ISO/IEC 27001 Lead Implementer or Lead Auditor.
- Cloud: CCSP, AWS Certified Security – Specialty, or Azure/GCP equivalents.
- Payments: PCI ISA, or prior experience working alongside a QSA.
- Privacy and AI governance: CIPP/US, CIPP/E, CIPT, IAPP AIGP (advantageous).

6. Working Style and Leadership Expectations

- Hands-on ownership: personally writes policies, configures tools, answers questionnaires and reviews architecture — no large team to delegate to at the start.
- Pragmatic judgement: frames security in terms of revenue enablement, risk and cost, and proposes practical trade-offs rather than maximum control.
- Explicit communication: explains risk concisely to leadership and holds credible technical conversations with customer security teams.
- Influence without authority: drives security outcomes through engineering, product, sales and operations.
- Composure under pressure: runs incidents in a structured way and escalates early and accurately.
- Integrity and candour: represents Orvera's security posture accurately to customers and auditors, including gaps.

7. Governance

- Security Steering Group: a monthly forum of the Group CFO, CTO and this role, which approves the security roadmap, risk acceptance decisions and major incident decisions.
- Information Security Officer: the role holder is formally designated in policy as Orvera's Information Security Officer for SOC 2, HIPAA and customer purposes.

📌 Senior Manager- Information Security and Compliance (Maharashtra)
🏢 Orvera.ai
📍 Maharashtra