Security & Compliance / Full-time
Security and Compliance Engineer, SOC 2 and ISO 27001
Run the control programme behind YTT Secunet's SOC 2 Type II, ISO 27001 and ISO 27701 reports, and answer the hardest security questionnaires we receive.
Team
Security & Compliance
Location
Chennai
Type
Full-time
Posted
15 Oct 2026
- Own control design and evidence collection for SOC 2 Type II, ISO 27001 and ISO 27701, automating evidence from cloud, identity and CI systems wherever possible.
- Maintain the subprocessor register and run vendor reviews, including transfer assessments for any subprocessor outside the EEA.
- Coordinate annual penetration tests and the bug bounty intake at security@yttsecunet.com, and track findings to closure.
- Answer customer security questionnaires and DORA and NIS2 related due diligence requests with Customer Engineering, and keep the Trust Center current.
- Run access reviews, joiner and leaver checks and secrets hygiene across both offices and all regional environments.
- Write the internal policies engineers actually read: short, specific and linked to the controls they support.
- Four or more years in security compliance or GRC at a SaaS or infrastructure company, including at least one SOC 2 Type II or ISO 27001 audit cycle you led.
- Working understanding of cloud security on at least one major provider: IAM, logging, key management and network controls.
- Ability to read infrastructure as code and CI pipelines well enough to turn them into audit evidence.
- Familiarity with GDPR obligations for processors, including Article 28 terms and Article 32 security measures.
- Precise writing for auditors, customers and engineers.
- CISA, CISSP, ISO 27001 Lead Implementer or Lead Auditor.
- Experience with ISO/IEC 42001 or AI governance programmes.
- Knowledge of DORA's ICT third-party risk requirements from the vendor side.
- 01Application review
- 02Intro call
- 03Paid work sample
- 04Panel
- 05Offer