GRC Intern

R360 Group; Bengaluru; On-site; INR 152,000 - 182,000; Part time

Job summary

R360 Group offers a paid internship providing mentored exposure to real audit cycles, evidence collection, and control-testing across six frameworks: ISO/IEC 27001:2022, ISO/IEC 27701, ISO/IEC 20000-1, SOC 2, DPDP Act 2023, and PCI DSS v4.0.1 on a BFSI-adjacent platform serving major banks.

Under supervision of senior GRC analysts, you will assist with evidence collection, risk register updates, policy reviews, and vendor questionnaire responses, gaining hands-on experience in audit preparation

Qualifications

• Pursuing/recently completed degree in IT, Information Security, Law, or related field.
• Basic understanding of information security and/or data privacy concepts; coursework or certifications are a plus.
• Detail-oriented with strong written English for documentation-heavy work.
• GRC interest in a compliance/audit career path.

Responsibilities

• Assist in evidence collection for ISO 27001, ISO 27701, ISO 20000-1, SOC 2, PCI DSS, and DPDP Act compliance activities.
• Support risk register updates and control-testing sample pulls.
• Assist with policy and procedure documentation reviews and version control.
• Support first-draft responses to vendor/client security questionnaires, reviewed by a senior GRC analyst before submission.
• Assist with audit logistics scheduling, evidence repository organisation, and auditor request tracking.
• Learn ROPA and DPIA basics under supervision as part of DPDP Act 2023 compliance work.
• Support security awareness training tracking and completion reporting.
• Assist with PCCB documentation review to flag compliance-relevant changes.

Skills

Written English

Attention to detail

GRC interest

Documentation

Education

Pursuing or recently completed degree in IT/Information Security/Law/Business Admin

Tools

GRC tools

Job description

R360 maintains concurrent conformance to six major compliance frameworks ISO/IEC 27001:2022, ISO/IEC 27701, ISO/IEC 20000-1, SOC 2, India's DPDP Act 2023, and PCI DSS v4.0.1 across a banking-linked platform serving HDFC Bank, ICICI Bank, and Kotak Mahindra Bank. This paid internship gives you structured, mentored exposure to real audit cycles, evidence collection, and control-testing work across all six frameworks a depth of multi-framework exposure that is uncommon at entry level, under the direct supervision of senior GRC analysts.

Key Responsibilities (Under Supervision)

• Assist in evidence collection for ISO 27001, ISO 27701, ISO 20000-1, SOC 2, PCI DSS, and DPDP Act compliance activities.
• Support risk register updates and control-testing sample pulls.
• Assist with policy and procedure documentation reviews and version control.
• Support first-draft responses to vendor/client security questionnaires, reviewed by a senior GRC analyst before submission.
• Assist with audit logistics scheduling, evidence repository organisation, and auditor request tracking.
• Learn ROPA and DPIA basics under supervision as part of DPDP Act 2023 compliance work.
• Support security awareness training tracking and completion reporting.
• Assist with PCCB documentation review to flag compliance-relevant changes.

Learning Outcomes

• Real-world exposure to six concurrent compliance frameworks inside a live BFSI-adjacent environment.
• Understanding of the full audit lifecycle preparation, evidence collection, auditor coordination, and closure.
• Foundational GRC skills that map directly to a GRC Analyst career path.
• Pursuing or recently completed a degree in Information Security, IT, Law, Business Administration, or a related field.
• Basic understanding of information security and/or data privacy concepts; relevant coursework or in-progress certifications are a plus.
• Detail-oriented with strong written English for documentation-heavy work.
• GRC — Governance, Risk & Compliance Hiring
• Genuine interest in a compliance/audit career path (as distinct from a purely technical/offensive-security track).

Preferred (Not Mandatory)

• ISO/IEC 27001 Foundation certificate, or actively pursuing one.
• Exposure to privacy law coursework (DPDP Act 2023, GDPR) is a plus.
• Comfort with Excel/Google Sheets and, ideally, some exposure to a GRC tool (ServiceNow GRC, OneTrust, Vanta, or similar).

Program Structure

1. Month 1–2 Foundations

Framework overview across ISO 27001, ISO 27701, ISO 20000-1, SOC 2, PCI DSS, and DPDP Act 2023; shadowing GRC analysts; tool walk throughs.

2. Month 3–4 Guided Evidence Collection

Hands-on evidence collection and control-testing support, with mandatory senior review before submission.

Independent ownership of low-risk documentation/evidence tasks (reviewed); capstone project — build one control-mapping matrix or mini gap-analysis across two frameworks.