# Security & Compliance Specialist

> Rolling Arrays - Consulting · India (Remote) · — · Posted 2026-11-04

**Workplace:** remote

**Department:** Human Resource

## Description

### **Role Summary:**

Rolling Arrays serves government and enterprise customers through two verticals: Rolling Arrays Technologies, which builds SaaS products for HR, and Rolling Arrays Consulting, which implements Tier 1 HRIS solutions. We hold ISO 27001, ISO 27017, ISO 27018 and SOC 2 Type II, and our customers — banks, statutory boards, large enterprises — expect us to prove it on every deal.

This role is the CISO's right hand across both businesses. You will run our security and compliance programme day to day — the ISMS and certifications, Scrut, board and customer inquiries, data protection, internal IT and asset governance — and work with Engineering and consulting delivery so that security is built in, not bolted on at audit time.

### **What you will do:**

### Governance, risk and compliance

-   Run the ISMS and Scrut as the system of record: policies, risk register, Statement of Applicability, asset inventory, control mapping and evidence.
-   Coordinate ISO 27001/27017/27018 and SOC 2 Type II audits, internal audits, and corrective actions through to closure.
-   Run vendor and sub-processor risk, and track PDPA (Singapore and Malaysia), GDPR, MAS TRM and BNM RMiT obligations.
-   Respond to board and executive inquiries and prepare management review material, keeping the CISO briefed on posture, risks and audit readiness.

### Customer assurance

-   Complete customer security questionnaires, vendor-risk assessments and due-diligence packs accurately and on the deal's timeline.
-   Respond to customer inquiries and audit requests: contractual security clauses, incident and breach notifications, and post-assessment follow-ups.
-   Maintain the answer library and trust vault, and join customer security calls alongside the CISO.

### Data protection and information governance

-   Set the data protection strategy: classification, handling, retention and disposal of customer and employee data across product and consulting work, aligned with PDPA, GDPR and customer commitments.
-   Operate controls that keep customer data within our control — DLP, limits on bulk downloads, removable media and personal cloud or email forwarding — and detect and investigate leakage.
-   Embed privacy by design with Product, Engineering and delivery (data mapping, impact assessments), and lead the data-breach procedure with the CISO.

### Internal IT, asset management and governance

-   Administer Google Workspace and core SaaS tools (Jira, Bitbucket, Slack): accounts, SSO/MFA and access matrices.
-   Own IT asset management and endpoint security across the lifecycle: MDM, a device inventory reconciled to the ISMS asset inventory, encryption, patching, returns and secure disposal.
-   Govern internal IT through asset, device and acceptable-use policies, and be the escalation point for staff security questions.

### DevSecOps and security operations

-   Embed security in the SDLC: SAST, SCA and secret scanning in CI, secure code review and security acceptance criteria.
-   Own vulnerability management: annual VAPT, triage, remediation against SLA and verification.
-   Review cloud security posture across AWS and Google Workspace (and GCP / SAP BTP where used).
-   Support incident response, access reviews, joiner/mover/leaver checks and security awareness training, and automate evidence collection where possible.

## Requirements

### Must have

1.  4–8 years in information security, including 2+ years hands-on in GRC at a SaaS or technology company.
2.  Experience running or supporting ISO 27001 and/or SOC 2 audits end to end, including collecting evidence and facing the auditor.
3.  Working experience with a compliance automation platform — Scrut preferred; Vanta, Drata or Sprinto acceptable.
4.  Solid AWS cloud security fundamentals (IAM, VPC, KMS, CloudTrail, GuardDuty).
5.  Familiarity with secure SDLC and application security (OWASP Top 10, SAST/SCA).
6.  Clear written English and confident communication with senior audiences, including the board; able to work across teams without direct authority.

### Good to have

1.  DevOps experience — CI/CD, containers and infrastructure as code, plus Python or Bash scripting — so you can implement controls yourself.
2.  Certifications such as ISO 27001 Lead Implementer/Auditor, CISA, CISM, CRISC or AWS Certified Security – Specialty.
3.  Privacy and data protection experience: ISO 27701, DLP tooling, or AI governance (ISO 42001).
4.  Hands-on IT asset management with MDM tooling.
5.  Exposure to banking or public-sector customers in Southeast Asia.

### What success looks like in the first six months**:**

-   Audits close with no major non-conformities, and Scrut evidence is current with named owners.
-   Customer questionnaires and board, executive and customer inquiries are answered accurately and on time, without the CISO having to draft them.
-   VAPT findings are tracked to closure against SLA, and security scanning runs in the main CI pipelines.
-   The IT asset register is complete and reconciled to the ISMS asset inventory.

## Apply

[Apply at Rolling Arrays - Consulting](https://apply.workable.com/rolling-arrays-consulting/j/A34D34EAA9/apply)

---
Powered by [Workable](https://www.workable.com)