Senior Security Engineer - GRC

Vegapay Technologies Private Limited; Bengaluru; On-site; INR 4,000,000 - 7,000,000; Full time

Job summary

Vegapay Technologies Private Limited is seeking an experienced GRC professional to architect and scale governance, risk, and compliance for fintech infrastructure. You will own certifications, controls, and audit remediation while partnering with Security, Legal, Product, and Leadership to embed risk-aware practices across product development and operations.

You will drive RBI compliance, PCI-DSS and ISO27001/SOC2 programs, manage risk assessments, and coordinate audits with regulators and

Qualifications

• Bachelor’s degree in Engineering, Technology, Business, or related field (plus in fintech/banking is a plus)
• 6–8 years of Governance, Risk & Compliance experience in fintech/BFSI/payments

Responsibilities

• Own end-to-end delivery of ISO 27001, SOC 2 Type II, PCI-DSS audits and remediation tracking
• Embed controls into product and infrastructure design with Engineering and Security
• Lead vendor/third-party risk assessments and risk-based decision-making
• Prepare compliance dashboards, risk reports, and leadership/board updates
• Liaise with regulators, auditors, and banking/NBFC partners on compliance matters

Skills

Governance

Risk management

Compliance

Policy writing

Stakeholder management

Education

Bachelor’s degree in Engineering, Technology, or related field

Tools

ISO 27001

SOC 2

PCI-DSS

RBI guidelines

Job description

We're looking for an experienced GRC professional to build and scale our governance, risk, and compliance function. As a fintech infrastructure provider processing sensitive financial data on behalf of banks and NBFCs, we operate under significant regulatory scrutiny - this role will own the frameworks, certifications, and controls that keep Vegapay compliant, secure, and trusted by our regulated BFSI partners. You’ll work closely with Security, Engineering, Legal, Product, and leadership to embed governance and risk management into how we build and operate, while being the primary point of contact for client and auditor assurance.

The Hats You Will Wear

Governance & Policy Management

• Design, implement, and maintain information security and compliance policies, standards, and procedures aligned to ISO 27001, SOC 2, PCI-DSS, and RBI guidelines
• Establish and run governance forums (risk council, policy reviews) with leadership and cross-functional stakeholders
• Own and maintain the organization’s risk register, control framework, and compliance calendar
• Conduct periodic enterprise and IT risk assessments, identifying gaps and driving remediation with process and engineering owners
• Define and track key risk indicators (KRIs) and key control indicators (KCIs) across the business
• Support risk-based decision-making for new products, partnerships, and vendor relationships
• Ensure ongoing compliance with RBI guidelines, payment ecosystem regulations (NPCI, card network mandates), and data protection requirements including the DPDPA
• Track regulatory and industry changes impacting fintech/BFSI operations and translate them into actionable requirements
• Liaise with regulators, external auditors, and banking/NBFC partners on compliance matters as needed
• Own and coordinate RBI-related audits and regulatory inspections, including evidence submission, query resolution, and remediation tracking

Information Security Compliance & Audits

• Own end-to-end delivery of ISO 27001, SOC 2 Type II, PCI-DSS, and other certification audits — including evidence collection, auditor coordination, and remediation tracking
• Partner with Engineering and Security to embed controls into product and infrastructure design
• Drive closure of audit findings and monitor control effectiveness over time

Vendor & Third-Party Risk Management

• Design and operate a vendor/third-party risk assessment program covering onboarding due diligence, periodic reviews, and offboarding
• Review vendor contracts and SLAs for risk, security, and compliance clauses in partnership with Legal

Client & Stakeholder Assurance

• Respond to security and compliance due-diligence questionnaires and audits from banking and NBFC clients
• Represent Vegapay’s GRC posture in client and partner conversations, building trust with regulated BFSI customers
• Prepare compliance dashboards, risk reports, and leadership/board updates

The Perfect Fit

• Bachelor’s degree in Engineering, Technology, Business, or a related field; advanced degree is a plus
• 6–8 years of experience in Governance, Risk & Compliance, Information Security Compliance, IT Audit, or related roles — preferably within fintech, BFSI, SaaS, or payments
• Hands‑on experience implementing and managing ISO 27001, SOC 2, and PCI‑DSS programs, including leading external audits to closure
• Working knowledge of RBI regulations, payment ecosystem guidelines, and data protection laws (DPDPA/GDPR)
• Experience building and operating vendor/third-party risk management programs
• Strong stakeholder management skills, with the ability to work across Security, Engineering, Legal, and business teams
• Excellent written and verbal communication skills, including policy writing and executive-level reporting

Your Edge Over the Rest

• Professional certifications such as CISA, CRISC, CISSP, CISM, or ISO 27001 Lead Auditor/Implementer
• Prior experience in a regulated financial services, payments, or banking technology environment
• Exposure to cloud security governance (AWS/GCP) and DevSecOps practices
• Experience setting up or scaling a GRC function from the ground up in a startup environment
• Familiarity with GRC tooling and compliance automation platforms

The Problem We’re Solving

Financial institutions today are held back by legacy systems that are slow, rigid, and expensive to scale. Launching or evolving credit, lending, and UPI products often takes months, requires heavy engineering effort, and limits the ability to create personalized customer experiences.

At the same time, customer expectations have changed - speed, flexibility, and tailored financial products are no longer optional. Banks and fintechs need infrastructure that allows them to innovate quickly, adapt continuously, and scale without friction.

This is where we come in.

At Vegapay, we are building modern, configurable fintech infrastructure that enables banks, NBFCs, and enterprises to design, launch, and manage credit and payment programs with ease. Our platform brings together flexibility, speed, and control - helping our partners unlock new growth opportunities and deliver personalized banking experiences at scale.

The Opportunity Ahead

• Lead and shape high-impact engineering teams building real-world fintech infrastructure
• Drive both technical direction and team growth - with real ownership and decision‑making authority
• Work on complex, scalable systems that directly power banking, credit, and payments
• Collaborate with strong product and leadership teams in a fast‑moving, execution‑first environment