Security Engineer - Compliance

Arcana; Bengaluru; On-site; INR 4,000,000 - 7,000,000; Full time

Job summary

Arcana is seeking a Senior Compliance Engineer to own and strengthen its security, privacy, and AI compliance programs across product, engineering, cloud, and business operations. You will collaborate with Security, Legal, IT, and Engineering to translate requirements into practical controls and drive certification initiatives.

Ideal candidates have 5–8 years in information security compliance within a technology product company, with hands-on ISO 27001, SOC 2, and ISO 42001 experience,

Qualifications

• 5-8 years of hands-on information security compliance, GRC, or security assurance in a tech product company.
• Direct SaaS/FinTech/product environment experience is required.
• Hands-on ISO/IEC 27001 IT governance and ISMS implementation, risk assessment, control ownership, and external audits.
• Experience with SOC 2 including Trust Services Criteria, control design and testing, evidence management, and audit coordination.
• Hands-on experience with ISO/IEC 42001 including AI governance and audit readiness.
• Led or supported certification cycles for ISO 27001, SOC 2, and ISO 42001 with external auditors.
• Professional certifications such as ISO 27001 Lead Implementer/Auditor, CISA, CISM, CRISC, or CISSP.

Responsibilities

• Own and strengthen Arcana’s compliance program across ISO 27001, SOC 2, and ISO 42001.
• Coordinate customer security questionnaires and assurance evidence.
• Automate evidence collection, control monitoring, and audit workflows.
• Maintain traceability between policies, risks, controls, and evidence.
• Monitor regulatory and contractual changes and assess impact on controls.
• Support security incidents, vendor risk, and change management from a compliance lens.
• Promote a scalable compliance culture with continuous demonstration of controls.

Skills

Information security compliance

GRC

Security assurance

Education

ISO 27001 Lead Implementer / Lead Auditor

ISO 42001 Lead Implementer / Lead Auditor

CISA

CISM

CRISC

CISSP

Tools

Sprinto

Vanta

Drata

Secureframe

Job description

We are looking for a Senior Compliance Engineer (Bangalore/Coimbatore Location) to own and strengthen Arcana’s security, privacy, and AI compliance programs across our product, engineering, cloud, and business operations.

You will work closely with Security, Engineering, Infrastructure, IT, Legal, People, and business teams to translate compliance requirements into practical controls, maintain continuous audit readiness, and drive certification programs including ISO 27001, SOC 2, and ISO 42001.

What You’ll Do

• Own and continuously improve Arcana’s compliance program across ISO 27001, SOC 2, and ISO 42001, including control design, implementation, operation, and ongoing readiness.
• Support customer and partner assurance activities, including security questionnaires, due diligence requests, control explanations, and evidence coordination.
• Automate evidence collection, control monitoring, recurring reviews, and compliance workflows wherever practical to reduce manual effort and improve audit reliability.
• Maintain clear traceability between policies, risks, controls, technical implementations, evidence, findings, and framework requirements.
• Track regulatory, contractual, customer, and framework changes relevant to Arcana and assess their impact on existing controls and certification scope.
• Support security incidents, exceptions, vendor risk, business continuity, access reviews, change management, and other operational processes where compliance oversight is required.
• Help build a scalable compliance culture where teams understand their control responsibilities and can demonstrate compliance continuously, not only during audits.

What We’re Looking For

• 5-8 years of hands-on experience in information security compliance, GRC, security assurance, or a similar role within a technology product company.
• Direct experience working in SaaS, FinTech, enterprise software, data platforms, or another product-led technology environment. Product-company experience is required.
• Strong hands-on experience with ISO/IEC 27001, including ISMS implementation, risk assessment, control ownership, Statement of Applicability, internal audits, management reviews, corrective actions, and external certification audits.
• Strong hands-on experience with SOC 2, including Trust Services Criteria, control design and testing, evidence management, audit coordination, gap remediation, and Type I / Type II readiness.
• Hands-on experience implementing or operating ISO/IEC 42001 requirements, including AI management systems, AI governance, AI risk management, lifecycle controls, documented responsibilities, and audit readiness.
• Must have directly supported or led certification and attestation cycles for ISO 27001, SOC 2, and ISO 42001, working with external auditors and internal control owners from readiness through closure.
• Relevant certifications such as ISO 27001 Lead Implementer / Lead Auditor, ISO 42001 Lead Implementer / Lead Auditor, CISA, CISM, CRISC, or CISSP.
• Ability to understand technical environments, review control implementation with engineering teams, evaluate evidence quality, and distinguish between documented policy and actual operating effectiveness.
• Strong documentation and communication skills with the ability to write clear policies, standards, control descriptions, risk statements, remediation plans, and audit responses.
• Ability to manage multiple audits, findings, evidence requests, and remediation workstreams with clear ownership, prioritization, and follow-through.
• Strong problem-solving skills and the ability to work independently while partnering effectively with technical and non-technical stakeholders.

Good to Have

• Experience in FinTech, financial technology, analytics, AI-enabled products, or other highly regulated or enterprise-facing SaaS environments.
• Experience with compliance automation or GRC platforms such as Sprinto, Vanta, Drata, Secureframe, or similar tools.
• Familiarity with cloud and engineering environments such as GCP, Kubernetes, CI/CD, IAM, encryption, logging, vulnerability management, and secure software development.
• Experience mapping controls across multiple frameworks such as ISO 27001, SOC 2, ISO 42001, NIST, CIS, GDPR, or customer-specific requirements.
• Experience with third-party risk, customer security reviews, business continuity, privacy, or security risk management.