GRC Lead

True Foundry; Bengaluru; On-site; INR 2,000,000 - 2,800,000; Full time

Job summary

True Foundry in Bengaluru is hiring its first compliance leader to build an integrated program covering SOC 2 Type II, ISO 27001, ISO 27701, GDPR, HIPAA and ISO 42001. You will author policies, map controls, gather evidence, and interface directly with auditors.

You will also help sales by answering security questionnaires, run risk management, and own the audit lifecycle from planning to closure, including internal reviews and third-party assessments.

Qualifications

• 6+ years in GRC, IT audit or security compliance.
• Led SOC 2 Type II audit and ISO 27001 certification end-to-end.
• Working knowledge of GDPR and ISO 27701; practical exposure to HIPAA.
• Technical depth in AWS/GCP/Azure, IAM, logging, CI/CD.
• Strong policy writing and ability to explain controls to engineers in plain terms.

Responsibilities

• Run gap assessment across six frameworks and build a unified control set.
• Administer frameworks and control-to-test mapping, policy module, risk register, vendor risk management, DPIAs, and auditor workspace.
• Write and maintain the ISMS: scope, SoA, information security policies, procedures and risk methodology.
• Run the risk register and present risk status to leadership quarterly.
• Lead external audits end to end: plan SOC 2 window, ISO Stage 1/2, close findings.
• Run internal audits and management reviews required by ISO 27001/27701/42001.
• Build the privacy program: RoPA, DPIAs, DSAR process, SCCs, DPAs with customers/vendors.
• Run HIPAA readiness if PHI is in scope: risk analysis, BAAs, safeguards mapping.
• Stand up ISO 42001 AI management system: AI policy, AI system inventory, risk assessments.
• Run third-party risk management: vendor tiering, security reviews, subprocessor list.
• Answer customer security questionnaires; maintain answer library and knowledge base.
• Run policy training, tabletop exercises, and BCP/DR documentation.

Skills

GRC

IT audit

Security compliance

SOC 2 Type II

ISO 27001

ISO 27701

Data privacy

HIPAA

Risk management

Vendor risk management

Policy writing

Auditing

Cloud (AWS/GCP/Azure)

CI/CD understanding

Tools

Vanta

Vanta Trust Center

AWS

GCP

Azure

Job description

About the role

You will be our first compliance hire and will build one integrated compliance program covering SOC 2 Type II, ISO 27001, ISO 27701, GDPR, HIPAA and ISO 42001. You will write the policies, map the controls, collect the evidence, and sit across the table from the auditors yourself. You will also help sales close enterprise deals by answering security questionnaires.

What you will do

• Run a gap assessment across all six frameworks and build one unified control set with cross-mapping, so each control is tested once and reused.
• Be the admin of frameworks and custom controls, control-to-test mapping, the policy module (approval, versioning, acceptance campaigns), training tracking, the risk register, vendor risk management, the data inventory and DPIAs, and the auditor workspace.
• Write and maintain the ISMS: scope, Statement of Applicability, information security policies, procedures and the risk methodology.
• Run the risk register and risk treatment plans; present risk status to the leadership every quarter.
• Lead external audits end to end: pick auditors and certification bodies, plan the SOC 2 observation window, run ISO Stage 1 and Stage 2, and close findings.
• Run internal audits and management reviews required by ISO 27001, 27701 and 42001.
• Build the privacy program: RoPA, DPIAs, DSAR process, cross-border transfers (SCCs), DPAs with customers and vendors, breach notification.
• Run HIPAA readiness if PHI is in scope: risk analysis, BAAs, safeguards mapping.
• Stand up the ISO 42001 AI management system: AI policy, AI system inventory, AI risk and impact assessments, and controls over model and data lifecycle.
• Run third-party risk management: vendor tiering, security reviews, subprocessor list.
• Answer customer security questionnaires with Vanta Questionnaire Automation and run the Vanta Trust Center; maintain the answer library and knowledge base.
• Run policy training, tabletop exercises, and BCP/DR test documentation.

Must have

• 6+ years in GRC, IT audit or security compliance, 2+ of them in-house at a SaaS or cloud company.
• Led at least one SOC 2 Type II audit and one ISO 27001 certification from start to finish.
• Working knowledge of GDPR and ISO 27701; practical exposure to HIPAA.
• Enough technical depth in AWS, GCP or Azure, IAM, logging and CI/CD to judge whether evidence is real.
• Strong policy writing and the ability to explain controls to engineers in plain terms.
• Comfortable working alone and pushing work across teams without authority.

Good to have

• Certifications: ISO 27001 Lead Implementer or Lead Auditor, CISA, CISM, CIPP/E or CIPM, ISO 42001 Lead Implementer, CRISC.
• Exposure to ISO 42001, the EU AI Act or the NIST AI RMF.
• Background in a Big Four or audit firm plus in-house experience.
• Experience with Indian DPDP Act requirements.