Security & Compliance Specialist

This is a fully remote position, open to applicants in India.

📋 Description

• Manage the ISMS and Scrut as the primary system of record, which includes policies, risk register, Statement of Applicability, asset inventory, control mapping, and evidence.

• Facilitate ISO 27001/27017/27018 and SOC 2 Type II audits, overseeing internal audits and ensuring corrective actions are completed.

• Oversee vendor and sub-processor risk while monitoring compliance with PDPA, GDPR, MAS TRM, and BNM RMiT obligations.

• Address inquiries from the board and executives, preparing management review materials and briefing the CISO.

• Complete customer security questionnaires, vendor-risk assessments, and due diligence documentation.

• Respond to customer inquiries and audit requests, including contractual security clauses, incident and breach notifications, and follow-ups.

• Maintain the answer library and trust vault, participating in customer security calls alongside the CISO.

• Develop a data protection strategy that encompasses classification, handling, retention, and disposal of customer and employee data.

• Implement controls for DLP, bulk downloads, removable media, and personal cloud/email forwarding; identify and investigate potential data leaks.

• Integrate privacy by design principles with Product, Engineering, and delivery teams through data mapping and impact assessments.

• Lead the data breach response procedure in collaboration with the CISO.

• Administer Google Workspace, Jira, Bitbucket, and Slack, managing accounts, SSO/MFA, and access matrices.

• Take ownership of IT asset management and endpoint security, including MDM, device inventory, encryption, patching, returns, and secure disposal.

• Govern internal IT policies and act as an escalation point for staff regarding security inquiries.

• Incorporate security measures into the SDLC through SAST, SCA, secret scanning, secure code reviews, and security acceptance criteria.

• Manage vulnerability assessments, including annual VAPT, triage, SLA-based remediation, and verification.

• Evaluate cloud security posture across AWS and Google Workspace, as well as GCP/SAP BTP where applicable.

• Assist with incident response, access reviews, joiner/mover/leaver checks, security awareness training, and evidence-collection automation.

• During the first six months, ensure audits are closed without major non-conformities, maintain current evidence in Scrut, respond to inquiries accurately and promptly, resolve VAPT findings within SLA, conduct scanning in main CI pipelines, and reconcile IT and ISMS asset registers.

⛳️ Requirements

• 4–8 years of experience in information security, including at least 2 years of hands-on experience in GRC at a SaaS or technology company.

• Proven experience in managing or supporting ISO 27001 and/or SOC 2 audits from start to finish, including evidence collection and auditor interactions.

• Practical experience with a compliance automation platform — Scrut preferred; alternatives such as Vanta, Drata, or Sprinto are acceptable.

• Strong fundamentals in AWS cloud security (IAM, VPC, KMS, CloudTrail, GuardDuty).

• Familiarity with secure SDLC and application security principles (OWASP Top 10, SAST/SCA).

• Excellent written English skills and confident communication abilities with senior audiences, including board members; capable of collaborating across teams without direct authority.

• Preferred DevOps experience, including CI/CD, containers, and infrastructure as code, along with Python or Bash scripting.

• Relevant certifications such as ISO 27001 Lead Implementer/Auditor, CISA, CISM, CRISC, or AWS Certified Security – Specialty are preferred.

• Experience in privacy and data protection, including ISO 27701, DLP tooling, or AI governance (ISO 42001) is preferred.

• Hands-on IT asset management experience with MDM tooling is preferred.

• Familiarity with banking or public-sector clients in Southeast Asia is preferred.

🏝️ Benefits

• Competitive salary package.

• Opportunities for professional development and growth.

• Flexible work arrangements.

• Comprehensive health and wellness programs.