Senior Associate — Information Security & Privacy

Dhruva Space GmbH; Hyderabad; On-site; INR 1,500,000 - 2,100,000; Full time

Job summary

Dhruva Space GmbH is seeking a Senior Associate — Information Security & Privacy to operate and maintain our ISO 27001:2022 and ISO 27701:2019 based management systems in alignment with the DPDPA 2023. The role acts as the operational backbone for governance, risk, and compliance in a fast-paced space-technology environment.

You will manage documentation, risk registers, access reviews, privacy lifecycle, RoPA, data subject rights, DPAs, and support internal/external audits while driving

Qualifications

• Bachelor’s degree in Information Technology, Computer Science, Law, or a closely related field.
• 3–6 years of hands-on experience in information security, data privacy, or GRC.
• Knowledge of ISO/IEC 27001 and ISO/IEC 27701 in practice.
• Familiarity with DPDPA 2023 and data-protection concepts.
• Excellent documentation and detail-oriented approach.
• Strong communication across technical and non-technical stakeholders.
• Proficiency with Google Workspace and Zoho.
• Active certifications such as ISO 27001 Lead Implementer/Auditor, privacy certifications, or CISA/CISM.
• Experience in a certified ISMS/PIMS environment or regulated industry is preferred.

Responsibilities

• Maintain ISMS and PIMS documentation, SOPs, SARs as required.
• Manage risk assessment and treatment process with risk register.
• Evidence daily controls like access reviews, incident records, logging, backups, monitoring.
• Drive CAPA tracking and closure ahead of audits.
• Support audits by providing evidence and coordinating with auditees.
• Oversee privacy consent lifecycle and RoPA/PII disclosures.
• Handle Data Principal requests per procedures and timelines.
• Manage DPAs and vendor-compliance register.
• Support security and privacy awareness campaigns and phishing simulations.
• Collaborate with HR, Legal, Procurement, IT to embed security requirements.
• Monitor DPDPA developments and assist DPO with incident handling and KPI reporting.

Skills

GRC experience

Information security

Data privacy

Audit readiness

Education

Bachelor’s degree in IT, CS or Law

Tools

Google Workspace

Zoho

Endpoint protection

Awareness platforms

Job description

Dhruva Space is seeking a dedicated Senior Associate — Information Security & Privacy to operate and maintain our certified, combined Information Security Management System (ISO/IEC 27001:2022) and Privacy Information Management System (ISO/IEC 27701:2019) in alignment with the Digital Personal Data Protection Act 2023 (DPDPA). The primary purpose of this role is to serve as the operational backbone of the ISMS/PIMS, keeping the management system mature, compliant, and continually audit-ready. This position requires a proactive governance, risk, and compliance (GRC) or privacy professional who can manage operational controls, execute privacy programs, and drive continuous improvement within a fast-paced space-technology environment.

Key responsibilities include, but are not limited to:

• Maintain comprehensive ISMS documentation, including policies, standard operating procedures (SOPs), the Statement of Applicability, and risk registers under document control.
• Operate the risk assessment and treatment process by actively maintaining the risk register and tracking treatment actions with respective owners.
• Coordinate and evidence daily operational controls, such as access reviews, incident registers, logging, backup/restore records, and monitoring metrics.
• Manage the Corrective and Preventive Action (CAPA) tracker to drive findings, observations, and opportunities for improvement to closure ahead of audits.
• Support internal and external audits by preparing evidence, coordinating with auditees, and tracking post-audit findings.
• Operate the full privacy consent lifecycle, including capture, inventory, and withdrawal handling.
• Maintain the Records of Processing Activities (RoPA) and Records of PII Disclosures, while supporting Privacy Impact Assessments (PIAs) for new tools and vendors.
• Handle all Data Principal requests (access, correction, erasure, grievance, nomination) in accordance with defined procedures and statutory timelines.
• Manage vendor Data Processing Agreements (DPAs) and the vendor-compliance register to track processor obligations.
• Execute the organizational security and privacy awareness program, including training campaigns, phishing simulations, and remedial follow-ups.
• Collaborate cross-functionally with HR, Legal, Procurement, and IT to ensure security and privacy requirements are deeply embedded in operational processes.
• Monitor developments under the DPDPA 2023 and assist the Data Protection Officer (DPO) with incident handling, breach reporting, and management KPI reporting.

Candidate Requirements

• Bachelor’s degree in Information Technology, Computer Science, Law, or a closely related field.
• 3–6 years of hands‑on experience in information security, data privacy, or governance, risk, and compliance (GRC).
• Demonstrated working knowledge of ISO/IEC 27001 (and ideally ISO/IEC 27701), with a solid understanding of how a certified management system operates in practice.
• Strong familiarity with the Digital Personal Data Protection Act 2023 (DPDPA) and core data‑protection concepts such as consent, RoPA, and data‑principal rights.
• Excellent documentation, record-keeping, and evidence-management skills, with a precise and detail‑oriented approach.
• Outstanding communication skills with the ability to coordinate across functions and communicate effectively with both technical and non-technical stakeholders.
• Proficiency with common business tooling (e.g., Google Workspace, Zoho) and familiarity with security tooling (e.g., endpoint protection, awareness platforms).
• Possession of at least one relevant active certification, such as ISO 27001 Lead Implementer / Lead Auditor, a privacy certification (e.g., DCPP/DCPLA, CIPP), or CISA / CISM.
• Prior exposure to a certified ISMS/PIMS environment or a regulated/high‑assurance industry is highly preferred; understanding of sector‑specific obligations (e.g., CERT‑In directions) is a plus.