Senior Security & Compliance Lead – Certifications & GRC

PETADATA; Hyderabad; On-site; INR 4,000,000 - 7,000,000; Full time

Job summary

PETADATA is seeking a Senior Security & Compliance Lead Certifications & GRC to drive security certifications, governance, and risk management for a multi-tenant platform. The role requires hands-on leadership across SOC 2, ISO 27001, GDPR/privacy, HIPAA, PCI DSS, and related standards.

You will own ISMS development, build a unified control framework, and collaborate with engineering, cloud, and audit teams. Office in Hyderabad, India with USA time zones overlap.

Qualifications

• 10+ years in information security, GRC, or security compliance.
• Experience leading SOC 2 and ISO 27001 end-to-end.
• Strong SaaS and multi-tenant cloud security knowledge.
• Experience with AWS, GCP, or Azure and shared responsibility.
• Familiarity with GDPR/CCPA and privacy requirements.
• Security documentation and audit evidence management skills.
• Excellent communication with auditors and executives.

Responsibilities

• Own the security certification roadmap and audits.
• Lead SOC 2 / ISO 27001 programs end-to-end.
• Develop ISMS with policies, standards, and docs.
• Map controls across cloud and on-prem deployments.
• Partner with engineering to embed security into design.
• Manage vulnerability management, pen tests, remediation.
• Lead incident response, business continuity, and drills.
• Respond to security questionnaires and customer audits.

Skills

Information security

GRC leadership

Security certifications

Cloud security

Audit logging

Risk management

ISMS knowledge

Security documentation

Communication skills

Independence

Education

Bachelor's degree in CS/IT/Engineering

Tools

AWS

GCP

Azure

Vanta

Drata

Job description

Position: Senior Security & Compliance Lead Certifications & GRC

Location:Hyderabad (8:00 PM -5:00 AM IST)

Work Type: Full-Time

Experience: 10+ Years

PETADATA is looking for a Senior Security & Compliance Lead Certifications & GRC with strong experience in cybersecurity, risk management, compliance frameworks, and enterprise security solutions.

Roles & Responsibilities

Security Certifications & Compliance Program

• Own the organization's security certification roadmap, determining which certifications and attestations are required and prioritizing them based on business, customer, and market requirements.
• Lead certification programs such as SOC 2 Type I, SOC 2 Type II, ISO 27001, and, where applicable, ISO 27017/27018, GDPR/privacy, HIPAA, PCI DSS, or CSA STAR.
• Manage certifications end to end, including gap assessments, control design, control implementation, evidence collection, auditor selection, audit coordination, remediation, and certification.
• Establish and maintain an Information Security Management System (ISMS), including security policies, standards, procedures, and supporting documentation.
• Develop a unified control framework that can map controls across multiple security and compliance standards and deployment models.

Cloud & On-Premise Security

• Build and maintain the compliance posture for a multi-tenant cloud platform, including tenant isolation, data segregation, shared infrastructure controls, and cloud-provider responsibilities.
• Develop security and compliance requirements for on-premise and customer-deployed environments, including secure deployment, hardening, documentation, and customer audit support.
• Establish and maintain a clear shared-responsibility model across cloud and customer-managed deployments.
• Map security controls across cloud environments such as AWS, GCP, and Azure and ensure appropriate security responsibilities are documented and implemented.

Security Engineering & Risk Management

• Partner with Engineering and Architecture teams to ensure security controls are designed into the platform, rather than added after development.
• Drive implementation of controls covering encryption, access control, secrets management, logging and auditing, tenant isolation, and secure SDLC practices.
• Establish and manage vulnerability management, penetration testing, and security review processes, ensuring findings are tracked through remediation and closure.
• Conduct security risk assessments and manage third-party and vendor security risks.
• Work closely with technical teams to identify security gaps and develop practical remediation plans.

Security Operations & Business Continuity

• Establish and maintain incident response, business continuity, and disaster recovery plans, including regular testing and validation.
• Develop and deliver security awareness training and promote a security-first culture across the organization.
• Monitor security and compliance controls continuously and coordinate remediation when gaps are identified.
• Manage ongoing surveillance audits, recertification activities, and compliance monitoring as the organization, platform, and team evolve.

Customer Trust & Audit Management

• Own the organization's customer security and trust program, responding to security questionnaires, RFP security sections, vendor assessments, and customer audit requests.
• Maintain security and compliance documentation through a centralized trust/compliance portal.
• Work directly with customers to explain security controls, compliance posture, shared responsibilities, and deployment-specific requirements.
• Serve as the primary point of contact for auditors, customers, engineers, and executive stakeholders on security and compliance matters.
• Translate complex security requirements into clear policies, evidence, documentation, and actionable recommendations.

Note: Should be able to work independently and work in USA time zones

Required Qualifications & Skills

• 8+ years in information security, GRC, or security compliance.
• Hands-on experience leading SOC 2 and/or ISO 27001 certifications end to end.
• Strong knowledge of SaaS security, multi-tenant environments, cloud security, IAM, encryption, and audit logging.
• Experience with AWS, GCP, or Azure and cloud shared responsibility.
• Experience with on-premise/customer-deployed software security and compliance.
• Strong understanding of risk management, control frameworks, ISMS, audits, and continuous compliance.
• Knowledge of GDPR, CCPA, and other relevant privacy requirements.
• Experience with vulnerability management, penetration testing, incident response, and vendor risk management.
• Strong security documentation and audit evidence management skills.
• Excellent communication skills with auditors, engineers, customers, and executives.
• Highly self-directed, with the ability to build and manage a security program independently.
• Preferred: CISSP, CISA, CISM, CCSP, ISO 27001 Lead Implementer/Auditor, and experience with HIPAA, PCI DSS, NIST, FedRAMP, Vanta, Drata, or DevSecOps.

Education

Bachelor s degree in Computer Science, Information Technology, Engineering, or a related field.

Candidates are required to attend Phone/video calls and in-person interviews. After the Selection, the candidate (He/She) should undergo all background checks on Education and Experience.