Risk And Compliance Analyst

BM Academy; Zone 7 Ambattur; On-site; INR 300,000 - 420,000; Full time

Job summary

BM Academy seeks a detail-oriented Compliance & Documentation Executive to help maintain our ISO 27001 ISMS and support SOC 2 audit readiness. This entry-level role suits a graduate with exposure to accounting, compliance, audit, or technology who enjoys structured documentation and cross-functional coordination.

You will manage policies, records, controls, evidence collection, and cross-team collaboration to ensure timely compliance.

Qualifications

• Graduate with exposure to accounting, compliance, audit, or technology.
• Experience in documenting SOPs/WIs and process flowcharts is desirable.
• Basic understanding of ISO 27001, SOC 2, risk, controls, or audit documentation; willingness to learn.

Responsibilities

• Maintain and update ISMS policies, procedures, registers, control matrices, and records.
• Coordinate SOC 2 readiness activities, including evidence collection and audit requests.
• Manage document naming, approvals, version control, and secure storage.
• Work with IT, HR, Finance, Legal, and business teams to obtain compliance evidence.
• Maintain risk, incident, asset, vendor, access-review, training, and corrective-action trackers.
• Support internal audits, management reviews, and closure of findings.
• Prepare status updates, meeting notes, dashboards, and audit-ready documentation.
• Monitor compliance actions and escalate delays or gaps.

Skills

Documentation

Compliance

Audit support

ISMS

English writing

Cross-functional coordination

Education

Graduate degree (any discipline)

CA/CWA Inter useful

Tools

Microsoft Word

Microsoft Excel

Microsoft PowerPoint

Job description

Compliance & Documentation Executive

Information Security Compliance | ISO 27001 | SOC 2

Role Summary

We are a growing 50-person startup seeking a detail-oriented Compliance & Documentation Executive to help maintain our newly certified ISO 27001 Information Security Management System (ISMS) and support SOC 2 audit readiness. This entry-level role suits a graduate with exposure to accounting, compliance, audit, or technology who enjoys structured documentation and cross-functional coordination.

Key Responsibilities

• Maintain and update ISMS policies, procedures, registers, control matrices, and supporting records.
• Coordinate SOC 2 readiness activities, including evidence collection, control tracking, audit requests, and follow-ups.
• Manage document naming, approvals, version control, review dates, and secure storage.
• Work with IT, HR, Finance, Legal, and business teams to obtain accurate and timely compliance evidence.
• Maintain risk, incident, asset, vendor, access-review, training, and corrective-action trackers.
• Support internal audits, management reviews, awareness activities, and closure of findings.
• Prepare concise status updates, meeting notes, dashboards, and audit-ready documentation.
• Monitor assigned compliance actions and **escalate** delays or documentation gaps.

Qualifications & Skills

• Graduate in any discipline; accounting, commerce, business, compliance, information systems, or technology exposure or CA/CWA Inter is useful.
• At least 1 year of experience in compliance, audit support, documentation, accounting operations, quality, information security, or a related field.
• Ability to handle confidential information and coordinate effectively in a fast-paced startup environment.
• Exposure to or experience with Lean / Six Sigma methodologies.
• Experience creating and reviewing work instructions (WIs), standard operating procedures (SOPs), and process flowcharts for finance processes is desirable.
• Basic understanding of ISO 27001, SOC 2, risk, controls, or audit documentation; willingness to learn is essential.
• Strong written English, attention to detail, follow-through, and proficiency in Microsoft Word, Excel, and PowerPoint.

Preferred

Exposure to ISO 27001:2022, SOC 2 Trust Services Criteria, internal audits, risk registers, vendor assessments, data privacy, or GRC/compliance tools. Relevant certifications or training are an advantage, not mandatory.