Security & Compliance Specialist

Job not on LinkedIn

🔥 1 minute ago

🇮🇳 India – Remote

⏰ Full Time

🟡 Mid-level

🟠 Senior

🚔 Compliance

👻 Ghost score 12%

What it means: the chance that no one is really hiring for this job.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Rolling Stories

WebsiteLinkedInAll Job Openings

11 - 50 employees

📱 Media

👥 HR Tech

Media • HR Tech

Rolling Stories is a series of podcasts produced by Rolling Arrays that shares experiences, learnings, and office humour from across the professional spectrum with a focus on HR, HR technology, and leadership. Episodes feature interviews and discussions about HR transformation, data-driven HR, employee experience, and practical lessons from HR leaders and practitioners. Rolling Stories is positioned as thought-leadership content supporting Rolling Arrays' HR tech consulting and transformation services.

📋 Description

• Run the ISMS and Scrut as the system of record, including policies, risk register, Statement of Applicability, asset inventory, control mapping and evidence • Coordinate ISO 27001/27017/27018 and SOC 2 Type II audits, internal audits and corrective actions through closure • Run vendor and sub-processor risk and track PDPA, GDPR, MAS TRM and BNM RMiT obligations • Respond to board and executive inquiries and prepare management review material while briefing the CISO • Complete customer security questionnaires, vendor-risk assessments and due-diligence packs • Respond to customer inquiries and audit requests, including contractual security clauses, incident and breach notifications and follow-ups • Maintain the answer library and trust vault and join customer security calls alongside the CISO • Set data protection strategy covering classification, handling, retention and disposal of customer and employee data • Operate DLP, bulk-download, removable-media and personal-cloud/email-forwarding controls; detect and investigate leakage • Embed privacy by design with Product, Engineering and delivery through data mapping and impact assessments • Lead the data-breach procedure with the CISO • Administer Google Workspace, Jira, Bitbucket and Slack, including accounts, SSO/MFA and access matrices • Own IT asset management and endpoint security, including MDM, device inventory, encryption, patching, returns and secure disposal • Govern internal IT policies and serve as escalation point for staff security questions • Embed security in the SDLC through SAST, SCA, secret scanning, secure code review and security acceptance criteria • Own vulnerability management, including annual VAPT, triage, SLA-based remediation and verification • Review cloud security posture across AWS and Google Workspace, plus GCP/SAP BTP where used • Support incident response, access reviews, joiner/mover/leaver checks, security awareness training and evidence-collection automation • In the first six months, close audits without major non-conformities, keep Scrut evidence current, answer inquiries accurately and on time, close VAPT findings against SLA, run scanning in main CI pipelines and reconcile IT and ISMS asset registers

🎯 Requirements

• 4–8 years in information security, including 2+ years hands-on in GRC at a SaaS or technology company • Experience running or supporting ISO 27001 and/or SOC 2 audits end to end, including collecting evidence and facing the auditor • Working experience with a compliance automation platform — Scrut preferred; Vanta, Drata or Sprinto acceptable • Solid AWS cloud security fundamentals (IAM, VPC, KMS, CloudTrail, GuardDuty) • Familiarity with secure SDLC and application security (OWASP Top 10, SAST/SCA) • Clear written English and confident communication with senior audiences, including the board; able to work across teams without direct authority • DevOps experience — CI/CD, containers and infrastructure as code, plus Python or Bash scripting — preferred • Certifications such as ISO 27001 Lead Implementer/Auditor, CISA, CISM, CRISC or AWS Certified Security – Specialty preferred • Privacy and data protection experience: ISO 27701, DLP tooling, or AI governance (ISO 42001) preferred • Hands-on IT asset management with MDM tooling preferred • Exposure to banking or public-sector customers in Southeast Asia preferred

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume