Compliance Executive

Plutos One; Dadri; On-site; INR 1,200,000 - 1,800,000; Full time

Job summary

Plutos One in India seeks a detail-oriented Compliance Executive to strengthen GRC, ensure PCI-DSS and ISO 27001 alignment, and support audits across our IT landscape.

You will define risk controls, coordinate with engineering and security teams, and drive policy updates, training, and remediation tracking.

Qualifications

• 25+ years of hands‑on experience in GRC, information security compliance, or audit roles.
• Deep understanding of PCI-DSS v4.0 standards and ISO/IEC 27001:2022 requirements.
• Technical familiarity with cloud security (AWS/Azure/GCP), network security, encryption, VA/PT and access controls.

Responsibilities

• PCI-DSS Compliance: lead end‑to‑end compliance, scope, evidence, and AoC process.
• Collaborate with engineering, DevOps, and IT security to maintain CDE controls.
• ISO 27001 & framework management: support ISMS and audits in line with standards.
• GRC activities: conduct risk assessments and maintain the Enterprise Risk Register.
• Vendor & regulatory compliance: perform TPRM assessments and track regulators.
• Audit support & security awareness: main contact for audits and security training.

Skills

GRC

Information Security

Audit

PCI-DSS v4.0

ISO 27001:2022

Cloud security

Network security

Encryption standards

Vulnerability management

Access controls

Job description

Job Overview

We are looking for a detail-oriented and proactive Compliance Executive to manage and strengthen our Information Security, Governance, Risk, and Compliance (GRC) framework. In this role, you will play a key part in maintaining strict compliance standards, including PCI-DSS and ISO 27001, while supporting internal/external audits and risk management initiatives across our infrastructure.

Key Responsibilities

• PCI-DSS Compliance:
  
  • Lead end-to-end PCI-DSS compliance requirements, scope definition, evidence collection, and Annual Attestation of Compliance (AoC) process.
  • Work closely with engineering, DevOps, and IT security teams to ensure cardholder data environment (CDE) controls are implemented and continuously maintained.
• ISO 27001 & Framework Management:
  
  • Support the maintenance and continuous improvement of the Information Security Management System (ISMS) in alignment with ISO/IEC 27001 standards.
  • Conduct internal audits, gap analyses, and assist in third-party certification/surveillance audits.
• Governance, Risk & Compliance (GRC):
  
  • Execute periodic risk assessments across IT, cloud, and operational operations; maintain and update the Enterprise Risk Register.
  • Draft, review, and update information security policies, procedures, standard operating procedures (SOPs), and guidelines.
  • Coordinate with cross-functional teams to track remediation plans for security vulnerabilities, audit findings, and compliance gaps.
• Vendor Risk & Regulatory Compliance:
  
  • Perform Third-Party Risk Management (TPRM) assessments for vendors and key service providers.
  • Track regulatory guidelines (e.g., RBI/local financial regulators, GDPR/Data Privacy laws) applicable to the business.
• Audit Support & Security Awareness:
  
  • Serve as the main point of contact for external auditors, Qualified Security Assessors (QSAs), and clients during compliance reviews.
  • Plan and deliver company-wide security awareness training programs and phishing simulation campaigns.

Qualifications & Key Requirements

• Experience: 25 years of hands‑on experience in GRC, Information Security Compliance, or Audit roles.
• Core Expertise: Deep understanding of PCI-DSS v4.0 standards and ISO/IEC 27001:2022 requirements.
• Technical Familiarity: Understanding of cloud security (AWS/Azure/GCP), network security, encryption standards, vulnerability management (VA/PT), and access controls.

Certifications (Preferred / Plus)

• ISO 27001 Lead Auditor / Lead Implementer