Job highlights

- Write and maintain the ISMScolon
- pick auditors and certification bodiescomma
- Led at least one SOC 2 Type II audit and one ISO 27001 certification from start to finishperiod
- . Disclaimer: This job posting has been aggregated from external source
- Must have NewLine
- Experience with Indian DPDP Act requirementsperiod
- Good to have NewLine

About the role You will be our first compliance hire and will build one integrated compliance program covering SOC 2 Type IIcomma; ISO 27001comma; ISO 27701comma; GDPRcomma; HIPAA and ISO 42001period; You will write the policiescomma; map the controlscomma; collect the evidencecomma; and sit across the table from the auditors yourselfperiod; You will also help sales close enterprise deals by answering security questionnairesperiod;

What you will do NewLine;

NewLine;- Run a gap assessment across all six frameworks and build one unified control set with cross-mappingcomma; so each control is tested once and reusedperiod; NewLine;

- Be the admin of frameworks and custom controlscomma; control-to-test mappingcomma; the policy module lpar;approvalcomma; versioningcomma; acceptance campaignsrpar;comma; training trackingcomma; the risk registercomma; vendor risk managementcomma; the data inventory and DPIAscomma; and the auditor workspaceperiod; NewLine;
- Write and maintain the ISMScolon; scopecomma; Statement of Applicabilitycomma; information security policiescomma; procedures and the risk methodologyperiod; NewLine;
- Run the risk register and risk treatment planssemi; present risk status to the leadership every quarterperiod; NewLine;
- Lead external audits end to endcolon; pick auditors and certification bodiescomma; plan the SOC 2 observation windowcomma; run ISO Stage 1 and Stage 2comma; and close findingsperiod; NewLine;
- Run internal audits and management reviews required by ISO 27001comma; 27701 and 42001period; NewLine;




- Build the privacy programcolon; RoPAcomma; DPIAscomma; DSAR processcomma; cross-border transfers lpar;SCCsrpar;comma; DPAs with customers and vendorscomma; breach notificationperiod; NewLine;
- Run HIPAA readiness if PHI is in scopecolon; risk analysiscomma; BAAscomma; safeguards mappingperiod; NewLine;
- Stand up the ISO 42001 AI management systemcolon; AI policycomma; AI system inventorycomma; AI risk and impact assessmentscomma; and controls over model and data lifecycleperiod; NewLine;
- Run third-party risk managementcolon; vendor tieringcomma; security reviewscomma; subprocessor listperiod; NewLine;
- Answer customer security questionnaires with Vanta Questionnaire Automation and run the Vanta Trust Centersemi; maintain the answer library and knowledge baseperiod; NewLine;
- Run policy trainingcomma; tabletop exercisescomma; and BCPsol;DR test documentationperiod; NewLine; NewLine; Must have NewLine; NewLine;- 6plus; years in GRCcomma; IT audit or security compliancecomma; 2plus; of them in-house at a SaaS or cloud companyperiod; NewLine;
- Led at least one SOC 2 Type II audit and one ISO 27001 certification from start to finishperiod; NewLine;
- Working knowledge of GDPR and ISO 27701semi; practical exposure to HIPAAperiod; NewLine;
- Enough technical depth in AWScomma; GCP or Azurecomma; IAMcomma; logging and CIsol;CD to judge whether evidence is realperiod; NewLine;
- Strong policy writing and the ability to explain controls to engineers in plain termsperiod; NewLine;
- Comfortable working alone and pushing work across teams without authorityperiod; NewLine; NewLine; Positive to have NewLine; NewLine;- Certificationscolon; ISO 27001 Lead Implementer or Lead Auditorcomma; CISAcomma; CISMcomma; CIPPsol;E or CIPMcomma; ISO 42001 Lead Implementercomma; CRISCperiod; NewLine;
- Exposure to ISO 42001comma; the EU AI Act or the NIST AI RMFperiod; NewLine;
- Background in a Big Four or audit firm plus in-house experienceperiod; NewLine;
- Experience with Indian DPDP Act requirementsperiod; NewLine;

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.

📌 GRC Lead (Bengaluru)
🏢 TrueFoundry
📍 Bengaluru