Information Security Compliance Specialist

Huron; Bengaluru; Hybrid; INR 1,200,000 - 1,800,000; Full time

Job summary

Huron is seeking a Sr. Compliance Specialist (Associate) to support the ongoing update, rollout, and maintenance of IT and security policies and ISMS documentation. You will manage risk logs, policy exceptions, and collaborate with auditors and stakeholders across the business.

The role requires 2–4 years in GRC or related security roles, with familiarity in ISO 27001, SOC 2, HIPAA, and other frameworks, and willingness to work US business hours.

Qualifications

• Bachelor's degree required in a related discipline.
• 2–4 years in governance, risk, and compliance or related security roles.
• Familiarity with ISO 27001, ISO 22301, SOX, HIPAA, NIST, SOC 2 frameworks.

Responsibilities

• Review, update, and rollout IT and security policies; maintain ISMS docs.
• Maintain GRC risk and issue logs; track ratings, due dates, statuses.
• Manage policy exceptions with business teams; obtain leadership approval.
• Provide data for GRC metrics, KPIs, KRIs for reporting.
• Support BIAs, and DR testing including evidence and follow-up.
• Coordinate audits (ISO 27001, SOC 2, HIPAA, etc.) with auditors and stakeholders.
• Monitor CAPAs and audit non-conformities to closure.
• Assist with vendor risk activities and security reviews with Legal.
• Assist incident response and third-party risk teams with investigations.
• Support security awareness training and phishing follow-up.
• Contribute to process improvement across GRC workflows.

Skills

Communication skills

Organizational skills

Customer focus

Time management

Attention to detail

US business hours alignment

Education

Bachelor’s degree in Information Security or related field

Job description

As the Sr. Compliance Specialist (Associate), you will:

• Support the review, update, and rollout of Huron IT and Security policies and procedures, and maintain ISMS documentation for ISO/IEC 27001:2022
• Maintain the GRC risk and issue log and risk exception records, working with owners to keep ratings, due dates, and status current
• Manage policy exceptions (vulnerability, end-of-life (EOL), and other requests) with business teams, tracking deadlines and obtaining leadership approval
• Gather data for GRC and security metrics, KPIs, and KRIs for management reporting
• Support business impact analyses (BIAs) and business continuity and disaster recovery (DR) testing, including scoping, scheduling, evidence, and follow-up
• Facilitate internal, external, and client audits (e.g., ISO 27001, SOC 2, HIPAA, CMMC, SOX), coordinating auditors and stakeholders and ensuring evidence is complete, accurate, and audit-ready
• Monitor corrective and preventive actions (CAPA) and audit non-conformities through to closure
• Respond to client RFP security sections, questionnaires, and vendor risk assessments, and support contract reviews of security and data protection terms with Hurons Legal department, escalating non-standard terms
• Assist with vendor onboarding, software approvals, and vendor security reviews using third-party risk management practices
• Assist the Incident Response and third-party risk teams with security incident investigations
• Support security awareness efforts through training completion tracking, phishing follow-up, and Cybersecurity Awareness Month activities
• Contribute to continual process improvement and automation across all GRC workflows.

Requirements

• Bachelor’s degree required, preferably in Information Security, Information Technology, Information Systems, or a related discipline
• 2-4 years of experience in governance, risk, and compliance, IT audit, information security, or a related security or compliance role
• Working knowledge of common security, attestation, and compliance frameworks (e.g., ISO 27001, ISO 22301, SOX, HIPAA, NIST, SOC 2)
• Strong written and verbal communication skills, with the ability to summarize technical findings for a non-technical audience
• Excellent organizational skills, with the ability to manage a high volume of concurrent requests and track detail accurately
• Customer-oriented approach, comfortable working directly with auditors, clients, and internal stakeholders across IT, Legal, and the business
• Willingness to work US business hours as needed, coordinating daily with a primarily US-based security team