Security & Compliance Specialist

Overview

Security and compliance specialist supporting the CISO across Rolling Arrays Technologies (SaaS products for HR) and Rolling Arrays Consulting (Tier 1 HRIS implementation), running the security and compliance programme day to day.

What you'll do

• Run the ISMS and Scrut as the system of record: policies, risk register, Statement of Applicability, asset inventory, control mapping and evidence.
• Coordinate ISO 27001/27017/27018 and SOC 2 Type II audits, internal audits, and corrective actions through to closure.
• Run vendor and sub-processor risk, and track PDPA (Singapore and Malaysia), GDPR, MAS TRM and BNM RMiT obligations.
• Respond to board and executive inquiries and prepare management review material, keeping the CISO briefed on posture, risks and audit readiness.
• Complete customer security questionnaires, vendor-risk assessments and due-diligence packs accurately and on the deal's timeline.
• Respond to customer inquiries and audit requests, including contractual security clauses, incident and breach notifications, and post-assessment follow-ups.
• Maintain the answer library and trust vault, and join customer security calls alongside the CISO.
• Set the data protection strategy: classification, handling, retention and disposal of customer and employee data, aligned with PDPA, GDPR and customer commitments.
• Operate controls that keep customer data within our control, including DLP, limits on bulk downloads, removable media and personal cloud or email forwarding, and detect and investigate leakage.
• Embed privacy by design with Product, Engineering and delivery (data mapping, impact assessments), and lead the data-breach procedure with the CISO.
• Administer Google Workspace and core SaaS tools (Jira, Bitbucket, Slack): accounts, SSO/MFA and access matrices.
• Own IT asset management and endpoint security across the lifecycle: MDM, a device inventory reconciled to the ISMS asset inventory, encryption, patching, returns and secure disposal.
• Govern internal IT through asset, device and acceptable-use policies, and be the escalation point for staff security questions.
• Embed security in the SDLC: SAST, SCA and secret scanning in CI, secure code review and security acceptance criteria.
• Own vulnerability management: annual VAPT, triage, remediation against SLA and verification.
• Review cloud security posture across AWS and Google Workspace (and GCP / SAP BTP where used).
• Support incident response, access reviews, joiner/mover/leaver checks and security awareness training, and automate evidence collection where possible.

What you'll need

• 4–8 years in information security, including 2+ years hands-on in GRC at a SaaS or technology company.
• Experience running or supporting ISO 27001 and/or SOC 2 audits end to end, including collecting evidence and facing the auditor.
• Working experience with a compliance automation platform: Scrut, or Vanta, Drata or Sprinto.
• Solid AWS cloud security fundamentals (IAM, VPC, KMS, CloudTrail, GuardDuty).
• Familiarity with secure SDLC and application security (OWASP Top 10, SAST/SCA).
• Clear written English and confident communication with senior audiences, including the board; able to work across teams without direct authority.

Nice to have

• DevOps experience: CI/CD, containers and infrastructure as code, plus Python or Bash scripting.
• Certifications such as ISO 27001 Lead Implementer/Auditor, CISA, CISM, CRISC or AWS Certified Security – Specialty.
• Privacy and data protection experience: ISO 27701, DLP tooling, or AI governance (ISO 42001).
• Hands-on IT asset management with MDM tooling.
• Exposure to banking or public-sector customers in Southeast Asia.

Details

• Location: India.