Senior Compliance Analyst

PENN ENGINEERING; Bengaluru; On-site; INR 1,200,000 - 1,800,000; Full time

Job summary

PENN ENGINEERING is seeking a Senior Compliance Analyst to join the IS Risk & Compliance team in Bengaluru. You will own defined compliance controls, perform audits, and drive day-to-day operations while partnering with IT risk and security teams to meet regulatory requirements.

You will lead audits, maintain compliance metrics, draft remediation plans, and support policy and training initiatives. Strong English communication and 5+ years' experience are required.

Qualifications

• 5+ years of IT compliance, audit and risk management experience.
• Experience with ISO 27001, SOC, or similar frameworks.
• Experience supporting external audits and maintaining controls.
• Strong documentation and stakeholder communication skills.
• Fluent English, written and spoken for global collaboration.

Responsibilities

• Own compliance controls and monitoring across domains like access governance and data reviews.
• Lead audit activities, including evidence collection and walkthroughs.
• Maintain tracking, metrics, and remediation statuses in governance tools.
• Draft audit responses and remediation plans; escalate gaps with analysis.
• Support policy updates and training coordination via KnowBe4.
• Collaborate with risk, security and IT teams to meet regulatory requirements.

Skills

IT compliance

Audit

Risk management

ISO 27001

SOC

Documentation

Stakeholder comms

GRC platforms

Education

Bachelor's in Information Systems / related field

Tools

Archer

Drata

Vanta

KnowBe4

Jira

Active Directory

Job description

Department: Corporate Global Information System

Position Summary:

The Senior Compliance Analyst is a senior individual contributor within the PennEngineering IS Risk & Compliance team who supports the Compliance Program Owner by owning defined compliance sub-components, executing audits and assessments, and driving day-to-day compliance operations.

This role partners closely with the Sr. IT Risk & Security Engineer to ensure regulatory, audit, and governance requirements are met across the enterprise. While the Senior Compliance Analyst independently leads assigned compliance activities, overall program strategy, final risk decisions, and external accountability remain with the Program Owner.

The Senior Compliance Analyst reports to the Senior Manager, IT Risk, Security & Compliance.

Key Responsibility

Compliance Execution & Control Ownership

• Own the execution and ongoing monitoring of assigned compliance controls and domains (e.g., access governance, data access reviews, system compliance checks, operational controls).
• Perform independent reviews to validate that controls are operating as designed and documented.
• Maintain compliance tracking, metrics, and remediation status using Jira or other internal governance tools.
• Escalate control gaps, risks, and systemic issues to the Compliance Program Owner with clear analysis and recommendations.
• Lead assigned portions of internal and external audits, including:
  • Evidence collection and validation
  • Control walkthrough preparation
  • Interview preparation, execution and coordination with system and process owners
• Draft audit responses and remediation plans for assigned findings.
• Track remediation progress through closure and report status to the Compliance Program Owner.
• Support the Program Owner during audit planning, auditor interactions, and final reporting.

Policy & Documentation Maintenance

• Maintain and update assigned policies, standards, and procedures under the direction of the Compliance Program Owner.
• Perform policy gap assessments related to assigned systems or regulatory areas.
• Draft policy revisions and supporting documentation for review and approval.
• Support policy publication, attestation, and training coordination through platforms such as KnowBe4.

Vendor & Third-Party Risk Management

• Support and/or execute assigned vendor assessment activities and communications.
• Validate and review submitted vendor documentation (e.g., SOC reports, questionnaires).
• Asses and document identified risks and provide clear summaries and recommendations to the Compliance Program Owner.
• Track vendor responses, remediation actions and other follow up activities.

Training, Awareness & Operational Support

• Support security training initiatives by tracking completion, identifying non-compliance trends, and assisting with reporting and follow up communications.
• Ensure all newly onboarded users receive and complete the mandatory new user Security Awareness Training through KnowBe4.
• Support responses to, and research internal compliance and security related inquiries and requests.
• Where appropriate, participate in change management, security review, and compliance meetings as a subject-matter contributor.
• Identify opportunities to improve compliance workflows, tooling usage, documentation quality, and reporting efficiency.
• Assist with implementation and optimization of compliance tooling and processes.
• Collaborate with and support other compliance staff as needed.
• Stay current on regulatory and compliance developments relevant to assigned responsibilities.

Requirements:

• Bachelor’s degree in Information Systems, Cybersecurity, Risk Management, or related field (or equivalent experience).
• 5+ years of experience in IT compliance, audit and risk management.
• Experience with ISO 27001, SOC, or similar frameworks.
• Experience supporting external audits, conducting internal audits, and maintaining compliance controls.
• Strong documentation, analytical, and stakeholder communication skills.
• Demonstrated professional fluency in English (written and spoken) required for collaboration with global stakeholders and preparation of technical and compliance documentation

Preferred Qualifications:

• Experience with TISAX, GDPR and other frameworks.
• Strong familiarity with Jira, GRC platforms (e.g Archer, Drata, Vanta), and compliance training tools, Varonis and KnowBe4
• Experience with Third Party Risk Management (TPRM)
• Relevant professional certifications such as CISA, CRISC, or CISSP.
• Experience with Active Directory (LDAP), M365 Entra and Purview.