{"id":3740360,"url":"https://alion.io/job/rolling-arrays-security-compliance-specialist","title":"Security & Compliance Specialist","company":{"id":685469,"name":"Rolling Arrays","domain":"rollingarrays.com","url":"https://alion.io/company/rollingarrays","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workable","truth_index":{"grade":"A","score":95,"open_postings":14,"ghost_share":0,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":96,"computed_at":"2026-11-10T06:52:35Z"}},"role":"Enterprise Apps","role_family":"Enterprise Apps","seniority":null,"employment_type":null,"work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":[],"countries":[],"hiring_countries":["IN"],"hiring_countries_total":1,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Bitbucket","optional":false},{"name":"DLP","optional":false},{"name":"GCP","optional":false},{"name":"GDPR","optional":false},{"name":"Google Workspace","optional":false},{"name":"IAM","optional":false},{"name":"ISO 27001","optional":false},{"name":"Jira","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"SAP BTP","optional":false},{"name":"Slack","optional":false},{"name":"SOC 2","optional":false},{"name":"ABAP","optional":true},{"name":"CI/CD","optional":true},{"name":"ISO 42001","optional":true},{"name":"Python","optional":true}],"status":"live","first_seen_at":"2026-11-04T11:38:32Z","employer_posted_date":"2026-11-04","last_verified_at":"2026-11-11T00:34:47Z","board_verified":true,"closed_at":null,"days_open":6,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":6},"description":"Role Summary:\nRolling Arrays serves government and enterprise customers through two verticals: Rolling Arrays Technologies, which builds SaaS products for HR, and Rolling Arrays Consulting, which implements Tier 1 HRIS solutions. We hold ISO 27001, ISO 27017, ISO 27018 and SOC 2 Type II, and our customers - banks, statutory boards, large enterprises - expect us to prove it on every deal.\nThis role is the CISO's right hand across both businesses. You will run our security and compliance programme day to day - the ISMS and certifications, Scrut, board and customer inquiries, data protection, internal IT and asset governance - and work with Engineering and consulting delivery so that security is built in, not bolted on at audit time.\nWhat you will do:\nGovernance, risk and compliance\nRun the ISMS and Scrut as the system of record: policies, risk register, Statement of Applicability, asset inventory, control mapping and evidence.\nCoordinate ISO 27001/27017/27018 and SOC 2 Type II audits, internal audits, and corrective actions through to closure.\nRun vendor and sub-processor risk, and track PDPA (Singapore and Malaysia), GDPR, MAS TRM and BNM RMiT obligations.\nRespond to board and executive inquiries and prepare management review material, keeping the CISO briefed on posture, risks and audit readiness.\nCustomer assurance\nComplete customer security questionnaires, vendor-risk assessments and due-diligence packs accurately and on the deal's timeline.\nRespond to customer inquiries and audit requests: contractual security clauses, incident and breach notifications, and post-assessment follow-ups.\nMaintain the answer library and trust vault, and join customer security calls alongside the CISO.\nData protection and information governance\nSet the data protection strategy: classification, handling, retention and disposal of customer and employee data across product and consulting work, aligned with PDPA, GDPR and customer commitments.\nOperate controls that keep customer data within our control - DLP, limits on bulk downloads, removable media and personal cloud or email forwarding - and detect and investigate leakage.\nEmbed privacy by design with Product, Engineering and delivery (data mapping, impact assessments), and lead the data-breach procedure with the CISO.\nInternal IT, asset management and governance\nAdminister Google Workspace and core SaaS tools (Jira, Bitbucket, Slack): accounts, SSO/MFA and access matrices.\nOwn IT asset management and endpoint security across the lifecycle: MDM, a device inventory reconciled to the ISMS asset inventory, encryption, patching, returns and secure disposal.\nGovern internal IT through asset, device and acceptable-use policies, and be the escalation point for staff security questions.\nDevSecOps and security operations\nEmbed security in the SDLC: SAST, SCA and secret scanning in CI, secure code review and security acceptance criteria.\nOwn vulnerability management: annual VAPT, triage, remediation against SLA and verification.\nReview cloud security posture across AWS and Google Workspace (and GCP / SAP BTP where used).\nSupport incident response, access reviews, joiner/mover/leaver checks and security awareness training, and automate evidence collection where possible.\nRequirements\nMust have\n4-8 years in information security, including 2+ years hands-on in GRC at a SaaS or technology company.\nExperience running or supporting ISO 27001 and/or SOC 2 audits end to end, including collecting evidence and facing the auditor.\nWorking experience with a compliance automation platform - Scrut preferred; Vanta, Drata or Sprinto acceptable.\nSolid AWS cloud security fundamentals (IAM, VPC, KMS, CloudTrail, GuardDuty).\nFamiliarity with secure SDLC and application security (OWASP Top 10, SAST/SCA).\nClear written English and confident communication with senior audiences, including the board; able to work across teams without direct authority.\nGood to have\nDevOps experience - CI/CD, containers and infrastructure as code, plus Python or Bash scripting - so you can implement controls yourself.\nCertifications such as ISO 27001 Lead Implementer/Auditor, CISA, CISM, CRISC or AWS Certified Security - Specialty.\nPrivacy and data protection experience: ISO 27701, DLP tooling, or AI governance (ISO 42001).\nHands-on IT asset management with MDM tooling.\nExposure to banking or public-sector customers in Southeast Asia.\nWhat success looks like in the first six months :\nAudits close with no major non-conformities, and Scrut evidence is current with named owners.\nCustomer questionnaires and board, executive and customer inquiries are answered accurately and on time, without the CISO having to draft them.\nVAPT findings are tracked to closure against SLA, and security scanning runs in the main CI pipelines.\nThe IT asset register is complete and reconciled to the ISMS asset inventory.","description_format":"text","description_chars":4863,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"All levels","optional":false}]},"benefits":[],"hiring_locations":[{"name":"India","iso":"IN","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Enterprise Apps Implementation Partners","HR & Payroll Software"],"lifecycle":[{"event":"open","at":"2026-11-04T11:38:32Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":5,"expected_fill_days":96,"reasons":["conf:3","velocity","win:early"],"computed_at":"2026-11-10T06:52:35Z"},"pay":null,"html_url":"https://alion.io/job/rolling-arrays-security-compliance-specialist","json_url":"https://alion.io/job/rolling-arrays-security-compliance-specialist.json","meta":{"generated_at":"2026-11-11T04:06:50Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":4127,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-12T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":685469},"rest":"https://alion.io/mcp/rest/get_company?id=685469"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Frolling-arrays-security-compliance-specialist"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Frolling-arrays-security-compliance-specialist"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Frolling-arrays-security-compliance-specialist"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/rolling-arrays-security-compliance-specialist\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Frolling-arrays-security-compliance-specialist"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3740360}},{"tool":"search_jobs","arguments":{"company":"rollingarrays.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3740360},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}