IT Security Associate - Governance, Compliance and Risk

Overview

Governance, Risk and Compliance apprenticeship in Arrow's IT Risk and Governance team, supporting information security certifications, risk framework and compliance programs. Open to students who have completed a university degree and want to learn information security governance in a global technology distributor.

What you'll do

• Collect and track evidence for the global ISO 27001 certification program, chasing outstanding artefacts from control owners and keeping the evidence register current.
• Support CMMC Level 2 readiness by maintaining control status trackers and helping assemble documentation packages ahead of assessment milestones.
• Review vendor questionnaire responses against the Vendor Risk Assessment Standard and flag gaps for an analyst to validate.
• Support migration and data quality work when consolidating GRC tooling onto a unified platform, including mapping controls between frameworks and cleaning up legacy records.
• Maintain the security policy and standards governance library, including formatting, version control and tracking annual review dates.
• Prepare recurring reporting, including program status summaries and metrics for security leadership.
• Keep assigned trackers, registers and evidence repositories accurate and current, and raise slipping items before they become escalations.
• Draft clear, concise summaries of findings and status for review by an analyst, architect or the director.
• Follow up with control owners and stakeholders across Arrow to request evidence, clarify responses and confirm closure of open items.
• Compare documentation and questionnaire responses against Arrow standards and applicable control frameworks, and record where they do not line up.
• Handle confidential and restricted information with the discretion the classification requires, and complete all assigned security training on time.
• Attend program stand-ups and record accurate notes, actions and owners.

What you'll need

• Currently enrolled in a bachelor's or master's program at a recognized university in India, with at least one academic year remaining at the start of the apprenticeship.
• Studying a relevant field such as information technology, computer science, cyber security, information systems, engineering, commerce, law or business administration.
• Strong written and spoken English.
• Comfortable with Microsoft Excel, Word, PowerPoint and Teams, and willing to learn new tools quickly.
• Genuinely careful with detail.
• Available for the agreed weekly hours and able to overlap with colleagues in EMEA and the United States for part of the week.

Nice to have

• Coursework, certification study or project work touching information security, audit, risk management or data privacy.
• Familiarity at an introductory level with any control framework or standard, including ISO 27001, NIST, SOC 2, PCI DSS or GDPR.
• Exposure to a GRC, ticketing or project tracking platform, or to basic data handling in Excel or Power BI.
• Student leadership, campus club, hackathon or volunteer experience that shows follow-through.
• An interest in continuing in security governance after graduation.

Details

• Location: Bangalore (KA), India, Arrow GESC.
• Full-time apprenticeship; schedule designed around coursework and examinations.
• Reports to the Director, IT Risk and Governance.
• Annual fixed stipend of INR 30,000 per month.
• Medical insurance coverage of INR 500,000 (self), plus accidental and life cover as per policy.
• 20 days annual leave, 12 days casual/sick leave, and 10 days of festival and national holidays.
• On-the-job skill-based training, projects and assignments.