Information Security & GRC Specialist

Role Overview

We are seeking an experienced Information Security & GRC Specialist who will take ownership of the day-to-day management, implementation, monitoring, and continuous improvement of information security and compliance programs.

The candidate will be responsible for managing our Scrut.io compliance automation platform, coordinating internal and external audits, implementing security controls, maintaining compliance documentation, conducting risk assessments, and working closely with Engineering, DevOps, IT, HR, and management teams.

The role will involve implementing and maintaining controls aligned with the following regulatory and security frameworks:

• SOC 2 (Trust Services Criteria)
• HIPAA (Health Insurance Portability and Accountability Act)
• GDPR (General Data Protection Regulation)
• PCI DSS v4.0.1 (Payment Card Industry Data Security Standard)

The ideal candidate should have a good combination of technical security knowledge, Governance, Risk & Compliance (GRC) experience, and the ability to translate regulatory requirements into practical technical and operational controls.

Key Responsibilities

1. GRC Platform & Compliance Management

• Take ownership of the organization's Scrut.io platform, including configuration, monitoring, evidence collection, control mapping, and compliance tracking.
• Manage compliance activities, control statuses, evidence requests, and remediation tasks within Scrut.io.
• Ensure that security controls are implemented, documented, and operating effectively.
• Monitor automated compliance checks and investigate failed controls, security alerts, and configuration gaps.
• Coordinate with internal teams to resolve compliance gaps and track corrective action plans (CAPs) until closure.
• Maintain compliance dashboards, reports, audit trails, and management updates.
• Coordinate with external auditors, assessors, and compliance consultants during audits and assessments.

2. Information Security & Technical Control Implementation

• Work closely with Engineering and DevOps teams to implement and maintain technical security controls across AWS cloud infrastructure and applications.
• Review AWS security configurations, including EC2 instances, Security Groups, VPCs, VPN endpoints, RDS, S3, IAM, encryption, backups, and access management.
• Monitor cloud security posture and identify misconfigurations, excessive permissions, publicly exposed resources, and other security risks.
• Manage vulnerability assessments, penetration testing (VAPT), security findings, and remediation activities.
• Coordinate patch and vulnerability management activities and ensure security vulnerabilities are addressed within defined timelines.
• Monitor and review security configurations involving Cloudflare, firewalls, SSL/TLS, network access restrictions, and other security mechanisms.
• Assist in implementing secure access controls, MFA, privileged access management, IP restrictions, and suspicious login detection.
• Work with development teams to ensure secure software development practices, application security, and change management controls.
• Review security-related changes and ensure appropriate documentation, authorization, testing, and approvals.

3. SOC 2 Compliance

• Implement and maintain controls required for SOC 2 compliance.
• Coordinate evidence collection and periodic control testing.
• Monitor access reviews, change management, vulnerability management, incident management, backup procedures, and business continuity controls.
• Conduct periodic risk assessments and maintain risk registers.
• Track audit observations, exceptions, and corrective action plans.
• Ensure that policies, procedures, and supporting evidence remain current and audit-ready.

4. HIPAA Compliance

• Implement and monitor applicable HIPAA Security Rule and Privacy Rule requirements.
• Assist in conducting security risk assessments and maintaining risk management documentation.
• Ensure appropriate safeguards for electronic Protected Health Information (ePHI), where applicable.
• Maintain HIPAA-related policies, procedures, training records, and compliance evidence.
• Coordinate Business Associate Agreements (BAAs) and third-party security assessments.
• Support incident reporting, breach assessment, and breach notification procedures in coordination with management and legal advisors.

5. GDPR & Data Privacy Compliance

• Manage and maintain the organization's Records of Processing Activities (ROPA).
• Coordinate Data Protection Impact Assessments (DPIAs) and privacy risk assessments.
• Maintain data inventories, data flow documentation, data retention requirements, and third-party processor records.
• Assist in implementing Privacy-by-Design and data protection controls.
• Coordinate Data Subject Access Requests (DSARs), data deletion requests, and other privacy-related requests.
• Monitor cross-border data transfers and maintain applicable transfer impact assessments and supporting documentation.
• Coordinate personal data breach assessments and privacy incident response activities.

6. PCI DSS v4.0.1 Compliance

• Manage and implement applicable PCI DSS v4.0.1 security requirements across eCommerce and POS environments.
• Maintain PCI DSS scope documentation, system inventories, data flow diagrams, and responsibility matrices.
• Assist in implementing and monitoring PCI DSS requirements related to access control, encryption, logging, vulnerability management, and secure software development.
• Manage compliance activities relating to PCI DSS Requirements
• Coordinate vulnerability assessments, penetration testing, and remediation of PCI-related findings.
• Maintain PCI DSS evidence and support SAQ/ROC-related assessments as applicable to the organization's compliance scope.

7. Security Policies, Procedures & Documentation

• Develop, review, update, and maintain information security policies, standards, procedures, and guidelines.
• Maintain documentation relating to access control, encryption and key management, incident management, vulnerability management, change management, backup management, business continuity, and disaster recovery.
• Ensure periodic reviews and approvals of security policies by appropriate stakeholders.
• Maintain security risk registers, exception registers, asset inventories, vendor inventories, and compliance records.
• Prepare security documentation and responses for customer security questionnaires, vendor assessments, and RFPs.

8. Security Awareness & Internal Coordination

• Coordinate periodic information security, HIPAA, GDPR, and PCI DSS awareness training.
• Monitor employee completion of mandatory security training and policy acknowledgements.
• Coordinate employee onboarding and offboarding security requirements with HR and IT.
• Conduct periodic access reviews and follow up on identified access control gaps.
• Work with different departments to improve security awareness and ensure compliance with organizational policies.

Required Qualifications & Experience

• Bachelor's or Masters degree in Computer Science, Information Technology, Cybersecurity, or a related discipline.
• 58 years of experience in Information Security, GRC, IT Audit, Security Compliance, or a related field.
• Hands-on experience managing compliance platforms such as Scrut.io, Vanta, Drata, or similar tools.
• Practical experience implementing or maintaining SOC 2, HIPAA, GDPR, and/or PCI DSS controls.
• Good understanding of AWS cloud infrastructure and security concepts.
• Working knowledge of networking, firewalls, VPNs, security groups, IP restrictions, and SSL/TLS.
• Understanding of vulnerability management, penetration testing, security assessments, and remediation processes.
• Experience in security policy development, risk assessments, evidence collection, and audit coordination.
• Good understanding of encryption, access management, MFA, logging, monitoring, and incident response.
• Ability to work directly with Engineering and DevOps teams to implement technical security controls.
• Strong written and verbal communication skills.

Preferred Qualifications

• Experience managing multiple compliance frameworks within a SaaS or cloud-based technology company.
• Experience working with AWS security services and cloud security posture management.
• Familiarity with Cloudflare, AWS IAM, AWS Security Groups, AWS Client VPN, RDS, S3, and EC2 security configurations.
• Understanding of PCI DSS payment processing architectures, payment gateways, hosted payment pages, and tokenization.
• Experience with third-party risk management and vendor security assessments.
• Knowledge of business continuity planning (BCP), disaster recovery (DR), RTO, and RPO.
• Experience preparing customer security questionnaires and responding to enterprise security assessments.

Preferred Certifications

One or more of the following certifications would be an advantage:

• ISO 27001 Lead Implementer / Lead Auditor
• Certified Information Systems Auditor (CISA)
• Certified Information Systems Security Professional (CISSP)
• Certified Information Security Manager (CISM)
• Certified in Risk and Information Systems Control (CRISC)
• Certified in Healthcare Privacy and Security (CHPS)
• Certified Information Privacy Professional (CIPP/E)

What We Are Looking For

We are looking for someone who is:

• Proactive and capable of independently managing day-to-day information security and compliance activities.
• Technically oriented and comfortable discussing security configurations with developers and DevOps engineers.
• Detail-oriented with strong documentation and audit management skills.
• Capable of identifying compliance gaps and driving their resolution rather than simply reporting them.
• Comfortable coordinating with internal teams, external auditors, customers, and third-party service providers.
• Able to manage multiple compliance frameworks and prioritize activities based on security risks.
• Interested in continuously improving the organization's overall security posture.

Why Join ?

This role provides an opportunity to take ownership of a growing information security and compliance program and work across cloud infrastructure, application security, data privacy, and regulatory compliance.

You will work closely with senior management and technical teams and play an important role in strengthening the security and compliance maturity of a cloud-based technology platform.