Responsibilities

We are looking for an exceptional Senior GRC Analyst to join our growing team. In this role, you will lead compliance assessments for frameworks such as NIST 800-171, ISO 27001, NIST 800-53 (FedRAMP), PCI, MLPS and IRAP, while also driving broader security compliance efforts. The ideal candidate will use strong analytical, communication, and problem-solving skills to evaluate controls, identify gaps, and recommend improvements across security domains. You will also be responsible for:

• Lead and participate in both internal and external audits for frameworks including ISO 27001/27701, PCI-DSS, NIST 800-171, NIST 800-53 (FedRamp), and IRAP

• Experience using or exploring AI/automation tools to enhance, streamline, or scale Governance, Risk, and Compliance (GRC) processes and workflows

• Manage and oversee risk, compliance, and governance initiatives across teams

• Coordinate with process owners, control owners, auditors, and consultants to ensure findings are tracked and addressed

• Conduct risk assessments, security audits, and third-party/vendor risk reviews

• Review contracts to ensure security and compliance requirements are met

• Identify process gaps and recommend improvements to enhance the organization’s security posture

• Communicate risks and compliance requirements clearly to both technical and non-technical stakeholders

• Perform regular user access reviews

• Develop and track remediation plans for identified risks and issues

• Maintain and update the risk register

• Oversee vendor security assurance processes

• Collaborate with stakeholders to design and implement effective internal controls aligned with regulatory standards

• Support risk and security discussions across cross-functional teams

• Build strong working relationships across departments

• Take on additional responsibilities as needed

Requirements

Qualifications / Experience / Technical Skills

Please note that the working hours for this position are from 2:00 PM to 11:00 PM IST (overlap with U.S. Pacific Time required)

• 8+ years of experience in cybersecurity programs, audits, risk management, compliance, or remediation

• Experience working with cloud platforms such as AWS, Azure, or Google Cloud

• Proven ability to negotiate and prioritize risk remediation with internal stakeholders

• Bachelor’s degree in Information Systems, Computer Science, Information Security, or a related field

• Strong understanding of security controls, including cloud environments, firewalls, IDS/IPS, and vulnerability management

• Familiarity with NIST 800-171 and NIST Risk Management Framework (NIST 800-53)

• Experience auditing frameworks such as PCI-DSS, SOC 2, and ISO 27001/27701

• Relevant certifications (CISSP, CISA, PCI ISA, ISO, or similar) are preferred

• Ability to manage multiple priorities independently with minimal supervision

Soft Skills / Personal Characteristics

• Strong communication skills with the ability to translate compliance requirements into technical actions

• High energy and adaptability in a fast-paced environment

• Strong collaboration and a knowledge-sharing mindset

• Excellent time management and organizational skills

• High attention to detail, integrity, and ethical standards

• Willingness to learn and take on new challenges

Additional requirements

• May involve some international travel

• This position requires overlap with U.S. Pacific Time (PST) working hours. Candidates should be available and flexible to work from 2:00 PM to 11:00 PM IST.

• Strong hands-on experience with PCI audits, ISO 27001, NIST 800-171, FedRamp, SOC 2, and potentially IRAP is required.

To help your application stand out, please take time to answer the Job Application Questions below clearly and concisely. All submissions are reviewed by our Hiring Team, not evaluated by AI.

(REQ ID: 2760)

Responsibilities

We are looking for an exceptional Senior GRC Analyst to join our growing team. In this role, you will lead compliance assessments for frameworks such as NIST 800-171, ISO 27001, NIST 800-53 (FedRAMP), PCI, MLPS and IRAP, while also driving broader security compliance efforts. The ideal candidate will use strong analytical, communication, and problem-solving skills to evaluate controls, identify gaps, and recommend improvements across security domains. You will also be responsible for:

• Lead and participate in both internal and external audits for frameworks including ISO 27001/27701, PCI-DSS, NIST 800-171, NIST 800-53 (FedRamp), and IRAP

• Experience using or exploring AI/automation tools to enhance, streamline, or scale Governance, Risk, and Compliance (GRC) processes and workflows

• Manage and oversee risk, compliance, and governance initiatives across teams

• Coordinate with process owners, control owners, auditors, and consultants to ensure findings are tracked and addressed

• Conduct risk assessments, security audits, and third-party/vendor risk reviews

• Review contracts to ensure security and compliance requirements are met

• Identify process gaps and recommend improvements to enhance the organization’s security posture

• Communicate risks and compliance requirements clearly to both technical and non-technical stakeholders

• Perform regular user access reviews

• Develop and track remediation plans for identified risks and issues

• Maintain and update the risk register

• Oversee vendor security assurance processes

• Collaborate with stakeholders to design and implement effective internal controls aligned with regulatory standards

• Support risk and security discussions across cross-functional teams

• Build strong working relationships across departments

• Take on additional responsibilities as needed

Requirements

Qualifications / Experience / Technical Skills

Please note that the working hours for this position are from 2:00 PM to 11:00 PM IST (overlap with U.S. Pacific Time required)

• 8+ years of experience in cybersecurity programs, audits, risk management, compliance, or remediation

• Experience working with cloud platforms such as AWS, Azure, or Google Cloud

• Proven ability to negotiate and prioritize risk remediation with internal stakeholders

• Bachelor’s degree in Information Systems, Computer Science, Information Security, or a related field

• Strong understanding of security controls, including cloud environments, firewalls, IDS/IPS, and vulnerability management

• Familiarity with NIST 800-171 and NIST Risk Management Framework (NIST 800-53)

• Experience auditing frameworks such as PCI-DSS, SOC 2, and ISO 27001/27701

• Relevant certifications (CISSP, CISA, PCI ISA, ISO, or similar) are preferred

• Ability to manage multiple priorities independently with minimal supervision

Soft Skills / Personal Characteristics

• Strong communication skills with the ability to translate compliance requirements into technical actions

• High energy and adaptability in a fast-paced environment

• Strong collaboration and a knowledge-sharing mindset

• Excellent time management and organizational skills

• High attention to detail, integrity, and ethical standards

• Willingness to learn and take on new challenges

Additional requirements

• May involve some international travel

• This position requires overlap with U.S. Pacific Time (PST) working hours. Candidates should be available and flexible to work from 2:00 PM to 11:00 PM IST.

• Strong hands-on experience with PCI audits, ISO 27001, NIST 800-171, FedRamp, SOC 2, and potentially IRAP is required.

To help your application stand out, please take time to answer the Job Application Questions below clearly and concisely. All submissions are reviewed by our Hiring Team, not evaluated by AI.

(REQ ID: 2760)

Responsibilities

We are looking for an exceptional Senior GRC Analyst to join our growing team. In this role, you will lead compliance assessments for frameworks such as NIST 800-171, ISO 27001, NIST 800-53 (FedRAMP), PCI, MLPS and IRAP, while also driving broader security compliance efforts. The ideal candidate will use strong analytical, communication, and problem-solving skills to evaluate controls, identify gaps, and recommend improvements across security domains. You will also be responsible for:

• Lead and participate in both internal and external audits for frameworks including ISO 27001/27701, PCI-DSS, NIST 800-171, NIST 800-53 (FedRamp), and IRAP

• Experience using or exploring AI/automation tools to enhance, streamline, or scale Governance, Risk, and Compliance (GRC) processes and workflows

• Manage and oversee risk, compliance, and governance initiatives across teams

• Coordinate with process owners, control owners, auditors, and consultants to ensure findings are tracked and addressed

• Conduct risk assessments, security audits, and third-party/vendor risk reviews

• Review contracts to ensure security and compliance requirements are met

• Identify process gaps and recommend improvements to enhance the organization’s security posture

• Communicate risks and compliance requirements clearly to both technical and non-technical stakeholders

• Perform regular user access reviews

• Develop and track remediation plans for identified risks and issues

• Maintain and update the risk register

• Oversee vendor security assurance processes

• Collaborate with stakeholders to design and implement effective internal controls aligned with regulatory standards

• Support risk and security discussions across cross-functional teams

• Build strong working relationships across departments

• Take on additional responsibilities as needed

Requirements

Qualifications / Experience / Technical Skills

Please note that the working hours for this position are from 2:00 PM to 11:00 PM IST (overlap with U.S. Pacific Time required)

• 8+ years of experience in cybersecurity programs, audits, risk management, compliance, or remediation

• Experience working with cloud platforms such as AWS, Azure, or Google Cloud

• Proven ability to negotiate and prioritize risk remediation with internal stakeholders

• Bachelor’s degree in Information Systems, Computer Science, Information Security, or a related field

• Strong understanding of security controls, including cloud environments, firewalls, IDS/IPS, and vulnerability management

• Familiarity with NIST 800-171 and NIST Risk Management Framework (NIST 800-53)

• Experience auditing frameworks such as PCI-DSS, SOC 2, and ISO 27001/27701

• Relevant certifications (CISSP, CISA, PCI ISA, ISO, or similar) are preferred

• Ability to manage multiple priorities independently with minimal supervision

Soft Skills / Personal Characteristics

• Strong communication skills with the ability to translate compliance requirements into technical actions

• High energy and adaptability in a fast-paced environment

• Strong collaboration and a knowledge-sharing mindset

• Excellent time management and organizational skills

• High attention to detail, integrity, and ethical standards

• Willingness to learn and take on new challenges

Additional requirements

• May involve some international travel

• This position requires overlap with U.S. Pacific Time (PST) working hours. Candidates should be available and flexible to work from 2:00 PM to 11:00 PM IST.

• Strong hands-on experience with PCI audits, ISO 27001, NIST 800-171, FedRamp, SOC 2, and potentially IRAP is required.

To help your application stand out, please take time to answer the Job Application Questions below clearly and concisely. All submissions are reviewed by our Hiring Team, not evaluated by AI.

(REQ ID: 2760)

About the team & role:

• The Information Security organisation advances the overall state of security at Rubrik through critical initiatives and the coordination of large security projects. Information Security builds technologies, tools, and processes to better enable teams at Rubrik to develop secure software and protect data and systems with appropriate security controls. Information Security also develops systems to monitor and respond to attacks against our systems, provides awareness education to teams on security best practices for data protection, and ensures data sharing relationships with third parties in order to securely protect Rubrik information.

• We are seeking a Senior Security Engineer to bridge the gap between traditional Security Operations and modern Data Engineering. You will be responsible for the day-to-day health of our SIEM ecosystem while simultaneously contributing in transition toward a Security Data Lake architecture. This is a hands-on, high-impact role that leverages Programming, Cloud Warehouses and AI to defend a global multi-cloud footprint.

What you’ll do?

• SIEM Administration: Handle day-to-day operations of market-leading SIEM platforms (e.g., Splunk, Sentinel, or Chronicle). This includes log ingestion from a variety of sources like Network devices, 3rd party vendor APIs,  Cloud Services, Webhooks etc..  parsing/normalisation to a common schema, health monitoring checks,  User access management and Cost Monitoring.
• Security Data Lake Operationalisation: Develop and maintain the infrastructure/Platform that moves security telemetry from raw sources into Snowflake, BigQuery, or Databricks. Tune/Optimise Ingestion at Scale for cost efficiency and  Enable SOC team and Threat Detection team to leverage the Security Data lake for their Search and Analytics workloads. 
• AI & Agentic Automation: Proactively integrate AI tools and LLMs into daily workflows; develop AI agents to automate Tier 1/2 SecOps tasks like Incident Investigation and Response.
• Cross-Team Collaboration: Partner with global teams across time zones and manage Stakeholder communication.

Experience you'll need:

• Experience: 5+ years in Security Ops and Engineering, focusing on  Security Data management and Automation.
• SIEM and SOAR Mastery: Hands-on experience with at least one market-leading SIEM (Splunk, Microsoft Sentinel, Elastic) and SOAR platform (Palo Alto XSOAR, Splunk SOAR).
• Cloud Data Warehousing: Practical experience administering or developing within Snowflake, BigQuery, and/or Databricks. Prior experience in building/maintaining data platforms that can manage  50-100 TB/day data is a big plus.
• Programming: Strong proficiency in Python and Shell scripting.
• Data Engineering Knowledge: Understanding of Cloud warehouse and  Lakehouse concepts, Open Table formats and Search engines for a composable Security Data stack.
• Cloud Infrastructure: Solid experience in one major cloud (AWS/GCP/Azure); Multi-cloud familiarity is a major plus.
• AI Fluency: Demonstrated experience or strong inclination towards utilising various AI tools to significantly enhance effectiveness (force multiplier) and solve complex business problems, particularly within SecOps and GRC domains.
• Nice to have
  • Exposure to Cloud Logging frameworks and best practices for Security Telemetry ingestion.
  • Familiarity with container orchestration (Kubernetes/EKS/GKE).
  • Interest/experience in building AI-driven security workflows.
  • Knowledge of modern CI/CD patterns and DevOps security integrations.
  • Experience with Terraform or other IaC tools.

The Challenge

Due to rapid growth and increased demand for our Privacy, Security, Data Governance, GRC, Third-Party Risk, Ethics and Compliance, and ESG platform, OneTrust is seeking a Senior UX Designer to join the User Experience Design team within our dynamic Research and Development team.   

This team continually improves the usability, design, and overall experience of OneTrust offerings, including web applications and other products and services. It is an excellent opportunity to improve the experience of an exceptionally wide range of users around the world.   

Your Mission 

Purpose of the Job :

As members of 6sense’s Security department, the Security Engineering team protects the platform across application, infrastructure, and cloud domains. The Vulnerability Operations function ensures that vulnerabilities are identified, triaged, validated, and remediated in a consistent, timely, and risk‑based manner. Senior Security Engineers work closely with Engineering, CloudOps, Product, and GRC teams to operationalize vulnerability management processes, build automation, standardize workflows, and ensure secure-by-default practices. 

Responsibilities & Accountabilities :

• Ensure vulnerability management tools (e.g., Wiz, Invicti, Rapid7, GHAS, Ox) are correctly configured for appropriate coverage and accurate detection. 
• Perform hands-on triage, validation, and root cause analysis of vulnerabilities across AppSec, InfraSec, and CloudSec. 
• Track and report vulnerability status against SLAs, escalating to engineering owners as needed. 
• Build and maintain dashboards, filters, reports, and triage scripts to support visibility and automation. 
• Assist engineering teams in reproducing and remediating vulnerabilities, providing actionable guidance. 
• Support the bug bounty program operations (not ownership), including validation and coordination with engineering teams. 
• Conduct security reviews and threat modeling for high-risk systems or changes. 
• Participate in initiatives that holistically address systemic or multi‑domain vulnerabilities. 
• Contribute to development of automated security testing pipelines for validation of fixes. 
• Participate in on-call or off‑hours incident response related to critical vulnerabilities and time‑sensitive patches. 
• Contribute to quarterly OKRs and security engineering roadmap initiatives. 

Performance Measurement :

• Understands 6sense’s product, architecture, cloud footprint, and environment in depth. 
• Takes ownership of vulnerability triage and prioritization while escalating where required. 
• Proactively identifies and escalates AI/ML‑related vulnerabilities or misconfigurations in systems integrating LLMs or automated decisioning. 
• Meets tight deadlines and SLAs for vulnerability response and validation. 
• Maintains accurate and up-to-date triage scripts, documentation, dashboards, and workflows. 
• Participates in weekly 1:1s and skip levels; provides clear progress updates. 
• Supports security engineers and development teams with accurate, actionable analysis. 
• Effectively participates in incident response and post‑incident remediation. 

Educational and Experience Requirements :

• 5+ years of experience in security engineering across vulnerability management, AppSec, CloudSec, or InfraSec. 
• Experience with vulnerability tools (e.g., Wiz, Rapid7, Invicti, GHAS, SAST/DAST) and triage workflows. 
• Understanding of cloud security (AWS preferred) and modern microservices architectures. 
• Experience identifying and mitigating AI/ML‑related security risks, including model abuse, prompt‑injection vulnerabilities, and risks introduced by LLM‑based features. 
• Experience with scripting/automation (Python, Bash, JavaScript, etc.). 
• Experience working directly with engineering teams to address vulnerabilities. 
• Familiarity with frameworks such as OWASP, NIST, CIS Benchmarks, MITRE ATT&CK. 
• Experience with IaC security (Terraform, CloudFormation, Pulumi) preferred but not required. 

Preferred Qualifications :

• Bachelor's degree in a related field 
• Relevant industry certifications, such as AWS, CNCF, and GIAC are highly desirable 

Competencies and Behaviors :

• Establishes strong credibility with engineering partners. 
• Maintains a professional, outcome-focused demeanor. 
• Advocates for vulnerability and security best practices. 
• Works independently on complex triage and analysis tasks. 
• Manages competing priorities effectively, escalating when appropriate. 
• Communicates clearly across technical and non-technical audiences. 
• Maintains accuracy, attention to detail, and documentation hygiene. 

Toast creates technology to help restaurants and local businesses succeed in a digital world, helping business owners operate, increase sales, engage customers, and keep employees happy.

We are seeking a highly motivated Senior Corporate Security Analyst to join Toast’s Corporate Security team in Bangalore. This role is focused on hands-on corporate security execution and risk reduction across endpoints, identities, SaaS platforms, vendors, and data — not SOC monitoring or shift-based operations.

The ideal candidate has strong experience working in enterprise corporate security environments, understands how to balance security controls with business needs, and is comfortable partnering with IT, GRC, Procurement, Legal, and Engineering teams. You will own multiple CorpSec programs end-to-end and act as a senior individual contributor, while mentoring junior analysts and helping scale security practices across the organization.

A Day in Life (Responsibilities)

1. Corporate Security Execution & Risk Management

• Own and operate key corporate security controls across endpoint, SaaS, identity, vendor, and data security.
• Perform security risk assessments for business initiatives and translate findings into actionable remediation plans.
• Act as a security advisor to internal stakeholders, focusing on practical risk reduction.

2. Endpoint & SaaS Security

• Lead day-to-day security oversight for corporate endpoints and SaaS applications, including:
• EDR/XDR, device hardening, encryption, MDM/UEM
• Shadow IT discovery and SaaS risk reviews
• Partner with IT Operations and Governance teams to resolve alerts, misconfigurations, and policy gaps.
• Conduct periodic reviews of high-risk applications, browser extensions, and endpoint findings.

3. Vulnerability Management (Corporate Scope)

• Drive vulnerability management for corporate endpoints and internal business systems.
• Triage and prioritize vulnerabilities based on business impact and exploitability.
• Track remediation with IT teams and validate closure.

4. Identity & Access Management (IAM)

• Support enterprise IAM governance, including:
• Joiner / mover / leaver processes
• Access reviews and least-privilege enforcement
• MFA, SSO, device trust, and privileged access (PAM)
• Assist in access investigations and high-risk access exception reviews.

5. Vendor & Third-Party Security

• Conduct vendor security assessments for onboarding and periodic reviews.
• Review SOC 2 reports, security questionnaires, and supporting evidence.
• Track vendor risks, remediation actions, and re-assessments.
• Partner with Procurement, Legal, and GRC teams to ensure security requirements are met.

6. Data Protection & DLP

• Support data protection initiatives across Google Workspace, Slack, and other collaboration platforms.
• Assist with the design, tuning, and enforcement of DLP controls.
• Participate in investigations related to data exposure or misuse.

7. Security Awareness & Process Improvement

• Support security awareness training and phishing simulation programs.
• Maintain CorpSec policies, SOPs, and runbooks.
• Identify opportunities to improve efficiency through automation and tooling.

8. Mentorship & Ownership

• Mentor P2-level security analysts and provide technical guidance.
• Take ownership of CorpSec initiatives and deliver them end-to-end with minimal supervision.

9. Contractor Security Oversight

• Establish and enforce contractor access standards, ensuring strict security controls during onboarding and offboarding.
• Conduct periodic contractor access and activity audits, identifying and mitigating associated risks.

Work Mode: This role follows a hybrid work model, requiring a minimum of 2 days per week in the office.

What We’re Looking For

Required

• 6–10 years of experience in information security with strong corporate security exposure.
• Hands-on experience with:
• Endpoint security and EDR tools (e.g., CrowdStrike)
• Vendor security assessments and SOC 2 reviews
• IAM concepts (Okta, PAM, access reviews)
• SaaS and Shadow IT security
• Strong understanding of security frameworks (NIST CSF, ISO 27001, CIS Controls).
• Experience working closely with IT and governance teams.
• Strong written and verbal communication skills.

Preferred

• Experience with Google Workspace security and DLP.
• Exposure to GRC processes or platforms (ServiceNow GRC, OneTrust).
• Bachelor's degree in Computer Science, Information Security, or a related field; Master's degree preferred.
• Proven experience in developing and implementing security policies, procedures, and frameworks.Demonstrated experience in developing and delivering security awareness training and phishing exercises.
• Possess excellent skills and experience in leveraging AI tools for threat detection, incident response, vulnerability management, and other security functions.
• Familiarity with Google Workspace security features.
• Proficiency with security tools such as Reco.AI, Torq, Splunk, DataDog, bug bounty platforms, Okta Device Trust, BeyondTrust, BeyondCorp, and other SIEM, SOAR and Security tools commonly used in the market.
• Ability to work autonomously and prioritize multiple tasks in a fast-paced environment.
• Excellent verbal and written communication skills, with the ability to effectively communicate technical information to both technical and non-technical audiences. Proven ability to collaborate effectively with cross-functional teams.
• Quick learner and adaptable to new security tools and technologies as they are procured and implemented.
• Ability to adapt to environments, understand requirements, and actively collaborate within the team, with other teams, and with vendors.
• Provide technical guidance and mentorship to P2 security analysts, fostering their professional growth and ensuring alignment with corporate security objectives.
• Take initiative in leading projects and driving security initiatives.
• Relevant security certifications are a plus.

AI at Toast

At Toast, one of our company values is that we're hungry to build and learn. We believe learning new AI tools empowers us to build for our customers faster, more independently, and with higher quality. We provide these tools across all disciplines, from Engineering and Product to Sales and Support, and are inspired by how our Toasters are already driving real value with them. The people who thrive here are those who embrace changes that let us build more for our customers; it’s a core part of our culture.

Our Total Rewards Philosophy 
We strive to provide competitive compensation and benefits programs that help to attract, retain, and motivate the best and brightest people in our industry. Our total rewards package goes beyond great earnings potential and provides the means to a healthy lifestyle with the flexibility to meet Toasters’ changing needs. Learn more about our benefits at https://careers.toasttab.com/toast-benefits.

Lead Security Engineer

Couchbase — Bangalore, India | Information Security | Full-Time

About Couchbase

As industries race to embrace AI, traditional database solutions fall short of rising demands for versatility, performance, and affordability. Couchbase is leading the way with Capella, the developer data platform for critical applications in our AI world. By uniting transactional, analytical, mobile, and AI workloads into a seamless, fully managed solution, Couchbase empowers developers and enterprises to build and scale applications with unmatched flexibility, performance, and cost-efficiency—from cloud to edge. Trusted by over 30% of the Fortune 100, Couchbase is unlocking innovation, accelerating AI transformation, and redefining customer experiences. Come join our mission.

The Role

We are seeking a driven and versatile Lead Security Engineer to join Couchbase's global Information Security team as our first security hire in Bangalore. This is a unique opportunity to be foundational to Couchbase's 24x7 security coverage and grow alongside a world-class security organization.

You will be a broad contributor—supporting and partnering our Security Operations, GRC, Product and Application Security teams. Working closely with Engineering, Cloud, and GTM functions, you'll gain hands-on exposure across the full security lifecycle. This role is ideal for someone who thrives across disciplines, moves between strategic and tactical work with ease, and wants to help build something meaningful from the ground up.

As Couchbase's security presence in Bangalore grows, you will be instrumental in expanding timezone coverage for security monitoring, incident response, and compliance operations—serving as a key link in our global, follow-the-sun security model.

Key Responsibilities

Security Operations

• Lead and own the timezone-extended coverage for security monitoring, alert triage, and initial incident response as the primary regional point of contact for the global security model.
• Drive day-to-day security operations including threat detection, monitoring, and escalation using SIEM and other security tooling.
• Assist with vulnerability management workflows—identification, prioritization, and tracking remediation in collaboration with engineering and cloud teams.
• Contribute to the review and improvement of existing security processes and tooling, including SIEM, DLP, endpoint security, email security, and vulnerability management platforms.
• Support security incident response planning and execution, interfacing with Engineering, Cloud, and SOC teams during active incidents.
• Help maintain and improve business continuity and disaster recovery documentation and runbooks.

Governance, Risk & Compliance (GRC)

• Contribute to GRC activities by focusing on audit evidence collection, documentation, and the continuous improvement of policies/standards under GRC team guidance.
• Assist with compliance initiatives including SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR, CCPA, and other relevant frameworks.
• Help track and document security risks, control exceptions, and remediation plans across the enterprise.
• Contribute to audit evidence collection and documentation to support external assessments and certifications.
• Support privacy-by-design efforts, including data privacy assessments and alignment with evolving global data regulations.
• Assist in building governance frameworks for AI/ML workloads and data pipelines, ensuring responsible and compliant adoption of AI technologies.

Product & Application Security

• Provide support for Product/AppSec enablement efforts by assisting with the integration of application security tooling (SAST, DAST, SCA) into CI/CD pipelines.
• Partner with Product Security engineers in conducting security architecture reviews and threat modeling for Couchbase's Capella cloud platform and database products.
• Support the execution of static and dynamic code scan reviews and assist with triaging and tracking findings.
• Contribute to the management of Couchbase's bug bounty program, including triage, validation, and researcher communication.
• Assist with the planning and coordination of application penetration tests and tracking remediation of findings within defined SLAs.
• Help engineering teams understand and apply secure coding principles, including OWASP Top 10 and OWASP SAMM.
• Assist in completing security sections of RFP questionnaires and customer security reviews.

Cross-Functional Collaboration

• Build strong working relationships with Engineering, Product, Cloud, Legal, and Compliance teams to support security initiatives across the organization.
• Work with customers as needed to explain security policies or address product-related security questions.
• Champion a "security is everyone's job" mindset and help embed security into Couchbase's engineering-driven culture.
• Contribute to security metrics and reporting to help track maturity and drive continuous improvement.

Qualifications

Required

• 6–9 years of hands-on experience in information security spanning two or more domains: GRC, product/application security, or security operations.
• Working knowledge of major compliance frameworks (SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR, CCPA).
• Familiarity with application security principles including OWASP Top 10, threat modeling, SAST/DAST tooling, and secure SDLC practices.
• Practical experience with public cloud security on at least one of AWS, Azure, or GCP.
• Experience with security tooling such as SIEM (Splunk, Rapid7, AlienVault), endpoint security (SentinelOne, CrowdStrike), or DLP platforms (Netskope, Proofpoint).
• Strong written and verbal communication skills with the ability to collaborate effectively across engineering, product, and business teams.
• Growth mindset, intellectual curiosity, and a genuine desire to broaden expertise across multiple security disciplines.

Nice to Have

• Experience with bug bounty program management, penetration test coordination, or vulnerability management.
• Familiarity with CNAPP tools (Wiz, Sysdig, Prisma Cloud) or cloud-native security tooling.
• Understanding of IAM, key management, encryption, and network security fundamentals.
• Experience with MDM tools (Kandji, Jamf, WorkspaceOne) and automating workflows/processes.
• Hands-on experience working within a GRC function on audits, risk assessments, or policy management.
• Exposure to AI/ML security considerations or data governance in a cloud environment.
• Industry certifications such as Security+, CISSP, CISM, CEH, or equivalent.
• Bachelor's degree in Computer Science, Information Security, or a related field.

Why This Role

This is a rare chance to join a lean, high-caliber security team at a pivotal moment—both for Couchbase and for the Bangalore office. You won't be siloed. You'll work across GRC, product security, AppSec, and SecOps, learning from specialists in each domain while contributing meaningfully from day one. As the team grows, so will your scope and influence.

Couchbase is trusted by over 30% of the Fortune 100 to power mission-critical applications. Security isn't an afterthought here—it's foundational to everything we build.

JOB DESCRIPTION

Senior/Staff Engineer – InfoSec Risk & Compliance

Location: Bengaluru, India | Department: Information Security
Experience Level: 6-9+ years | Employment Type: Full-Time, Permanent

Lead compliance transformation and security governance scaling at Netradyne. Own enterprise GRC platform implementation, manage multi-framework audits (ISO 27001/42001, SOC 2, HIPAA), and drive customer compliance acceleration enabling enterprise revenue growth.

KEY RESPONSIBILITIES

Facilitate Audit & Certification

• Drive ISO 42001 (AI governance), SOC 2 Type II, RED Directive EN 18031, ISO 27001, HIPAA programs
• Design vendor risk assessment program with SLA enforcement
• Manage external audits and certification timelines

GRC Platform Implementation

• Lead enterprise GRC tool deployment and configuration across all frameworks
• Build automated evidence collection, remediation tracking, and compliance reporting
• Create executive risk dashboards and governance reporting

Customer Compliance & Revenue

• Build RFP/RFI response framework reducing turnaround to <10 business days
• Develop customer-facing Trust Centre portal reducing RFP volume
• Manage customer security questionnaires and account support

Risk Optimization & International Support

• Design quarterly self-assessment (QSA) process via GRC automation
• Maintain AI risk register (model degradation, bias, privacy risks)
• Support 15-country compliance expansion (GDPR, local regulations)

REQUIRED QUALIFICATIONS

Education & Certifications

• Bachelor’s/master’s degree in information security, Computer Science, or related field
• Active professional certification: CISSP, CCSP, CISM, CCSK, ISO 27001/42001 Lead Auditor, or equivalent
• Demonstrated audit Senior/Staff: ISO 27001 and/or SOC 2 field audit participation (2+ cycles)

Core Technical Competencies (Must Have)

KNOWLEDGE & PROFESSIONAL SKILLS

Technical Skills: (Should Have)

• Enterprise Resilience:Design BCP/DR, failover testing, 24/7 uptime SLAs for multi-region expansion
• AI Security:Threat modelling, adversarial attack scenarios, responsible AI assurance (ISO 42001)
• Cloud Compliance:Data classification, multi-region governance, DLP enforcement, CloudTrail/Azure Logs monitoring
• Infrastructure-as-Code:Terraform/CloudFormation for audit-trail automation
• API Integration:REST APIs for GRC, ticketing systems, SIEM/DLP tool integration

Preferred: IoT/embedded systems (RED Directive), RPA, network-layer authentication (RADIUS/LDAP), certificate management

Professional:

• Collaborate with cross-functional teams (IT, Engineering, Sales, Device, Finance, Legal, Privacy, HR) for compliance alignment
• Lead GRC platform implementation and governance workflow design
• Communicate risk and compliance status to executive leadership and board
• Support 24/7 on-call rotation for security incidents and emergencies
• Continuous learning mindset; ability to adopt emerging compliance frameworks (AI governance, new regulations)