Information Security Associate
First seen by Alion on Sep 11, 2026.
About EquityList:
EquityList is trusted by 600+ companies to manage their cap table and stock option workflows and compliance. Our comprehensive platform allows customers to manage and administer equity grants - ESOPs, SARs, RSUs, RSAs seamlessly and at scale.
Our customers span APAC, MENA, and the US, including Tata Consumer Products, Taco Bell, Blackbuck, Livspace, Slice, smallcase, Tabby.ai, and Shiprocket - managing equity for 50,000+ stakeholders and stock options worth $3Bn+. We're backed by AngelList India, Hustle Fund, Republic, Unpopular Ventures, Mana Ventures, and a stellar group of angels.
About the Role:
As we deepen our enterprise footprint across regulated markets - onboarding listed companies, fintechs, and compliance-driven clients across three geographies, security has moved from a checkbox to a core trust signal. Clients managing billions in equity on our platform expect us to meet enterprise-grade security standards, and we take that seriously. We're looking for an Information Security Associate who is hands-on, ownership-oriented, and equally comfortable hardening infrastructure and walking a client's CISO through our controls framework. You'll be our first dedicated security hire - which means you own the function, set the baseline, and ensure every enterprise prospect can trust EquityList with their most sensitive equity data.
Ideal Candidate Mindset:
You've been the only security person in a room full of engineers. You've written the first acceptable use policy and found a critical IDOR on the same day. You care about building systems and processes that outlast you, not just passing audits.
Key Responsibilities:
1. Security Operations:
- Own our day-to-day security posture, access controls, endpoint hardening, secrets management, and cloud security hygiene on GCP. Monitor SIEM alerts, investigate incidents, and lead post-incident reviews with written closure reports.
2. Vulnerability Management:
- Conduct periodic internal assessments and coordinate third-party VAPT engagements. Own the remediation tracker and ensure findings don't die in a spreadsheet.
3. Compliance & ISMS:
- Build and maintain our Information Security Management System - policies, risk registers, vendor assessments, and runbooks. Be the person who actually keeps these updated.
4. Certification Readiness:
- Support readiness for ISO 27001, SOC 2 Type II, and GDPR (EU) - maintaining evidence artefacts, coordinating with auditors, and closing gaps proactively.
5. Client-Facing Trust Building:
- Own our Infosec response library for enterprise RFPs, DDQs, and security annexures. Represent EquityList on client InfoSec calls with clarity and confidence.
6. Product and Application Security:
- Work with the engineering team on secure design reviews, threat modelling, and pre-release security checks - bringing security into the SDLC, not just after the fact.
7. Bug Bounty/Responsible disclosure programs:
- Take ownership of initiating and managing bug bounty programs.
8. Cross-functional Collaboration:
- Partner with Product, Compliance, and Business teams to translate security requirements into practical, executable controls without becoming a blocker.
Requirements:
Technical:
- 2 - 3 years in an InfoSec, security engineering, or GRC + technical hybrid role. Ideally, at a SaaS or fintech company.
- Working knowledge of GCP security - IAM, VPC service controls, Cloud Armor, Security Command Center, Cloud Logging, and alerting.
- Familiarity with OWASP Top 10, common vulnerability classes, and the ability to triage scanner output.
- Experience writing security policies, ISMS documentation, and risk registers - not just reading templates.
- Scripting ability (Python or Bash) for automating checks or log analysis is a plus.
Soft Skills:
- Strong written communication, you can translate technical risk into plain language for a founder, a CFO, or a client's legal team.
- Documentation-first mindset, you close loops and keep records clean without being reminded.
- Startup-ready, comfortable with ambiguity, proactive about gaps, and able to wear multiple hats.
Education:
- B.E. / B.Tech in Computer Science, IT, or related field - or equivalent practical experience.
- CompTIA Security+, CEH, or Google's Professional Cloud Security Engineer certification is a plus.
Good to Have:
- Hands-on involvement in ISO 27001 implementation or audit support.
- SOC 2 Type II readiness experience.
- VAPT coordination with third-party vendors.
- Awareness of India's DPDP Act and IT Act obligations.
- Prior experience at a B2B SaaS or fintech startup.
- Hands-on experience with DLP, MDM, or SIEM tooling.
- Build from scratch: You're EquityList's first security hire, you write the playbook, choose the tools, and define what security culture looks like here. No bureaucracy, full ownership.
- Work at the intersection of security and growth: At our stage, security directly enables revenue. You'll co-own enterprise onboarding conversations, influence product architecture, and build relationships with CISOs and CFOs at India's fastest-growing companies.
Skills
IT Security Strategy, Security Tools, Security Protocols, Security Operations Center, SIEM, Vulnerability Management, IT Compliance, ISMS, Python, Bash Scripting, IT Audit