TrueFoundry

Enterprise AI gateway and deployment platform

GRC Lead

Security Governance, Risk & ComplianceConfirmed live in the last 24 hours

Full-timeBengaluru, Karnataka, IndiaNo salary listedIn-person

About the Job

Requirements

At least 6 years of experience in GRC, IT audit, or security compliance, including at least 2 years in-house at a SaaS or cloud company.
Have led at least one SOC 2 Type II audit and one ISO 27001 certification from start to finish.
Have working knowledge of GDPR and ISO 27701 and practical exposure to HIPAA.
Have enough technical depth in AWS, GCP, or Azure, IAM, logging, and CI/CD to assess whether evidence is valid.
Be able to write policies and explain controls to engineers in plain terms.
Be comfortable working independently and advancing work across teams without authority.

Responsibilities

Run gap assessments across SOC 2 Type II, ISO 27001, ISO 27701, GDPR, HIPAA, and ISO 42001, and build a unified cross-mapped control set so each control can be tested once and reused.
Administer frameworks and custom controls, control-to-test mapping, policy approval/versioning/acceptance campaigns, training tracking, the risk register, vendor risk management, data inventory and DPIAs, and the auditor workspace.
Write and maintain the ISMS, including its scope, Statement of Applicability, information security policies, procedures, and risk methodology.
Run the risk register and risk treatment plans, and present risk status to leadership quarterly.
Lead external audits end to end, including selecting auditors and certification bodies, planning the SOC 2 observation window, running ISO Stage 1 and Stage 2 audits, and closing findings.
Run internal audits and management reviews required by ISO 27001, ISO 27701, and ISO 42001.
Build the privacy program, including RoPA, DPIAs, the DSAR process, cross-border transfers using SCCs, DPAs with customers and vendors, and breach notification.
Run HIPAA readiness when PHI is in scope, including risk analysis, BAAs, and safeguards mapping.
Establish the ISO 42001 AI management system, including an AI policy, AI system inventory, AI risk and impact assessments, and controls over model and data lifecycle.
Run third-party risk management, including vendor tiering, security reviews, and the subprocessor list.
Answer customer security questionnaires using Vanta Questionnaire Automation and run the Vanta Trust Center; maintain the answer library and knowledge base.
Run policy training and tabletop exercises, and document BCP/DR tests.

Desired Qualifications

ISO 27001 Lead Implementer or Lead Auditor certification, CISA, CISM, CIPP/E or CIPM, ISO 42001 Lead Implementer certification, or CRISC.
Exposure to ISO 42001, the EU AI Act, or the NIST AI RMF.
Background in a Big Four firm or audit firm, in addition to in-house experience.
Experience with Indian DPDP Act requirements.

About the role

You will be our first compliance hire and will build one integrated compliance program covering SOC 2 Type II, ISO 27001, ISO 27701, GDPR, HIPAA and ISO 42001. You will write the policies, map the controls, collect the evidence, and sit across the table from the auditors yourself. You will also help sales close enterprise deals by answering security questionnaires.

What you will do

Run a gap assessment across all six frameworks and build one unified control set with cross-mapping, so each control is tested once and reused.
Be the admin of frameworks and custom controls, control-to-test mapping, the policy module (approval, versioning, acceptance campaigns), training tracking, the risk register, vendor risk management, the data inventory and DPIAs, and the auditor workspace.
Write and maintain the ISMS: scope, Statement of Applicability, information security policies, procedures and the risk methodology.
Run the risk register and risk treatment plans; present risk status to the leadership every quarter.
Lead external audits end to end: pick auditors and certification bodies, plan the SOC 2 observation window, run ISO Stage 1 and Stage 2, and close findings.
Run internal audits and management reviews required by ISO 27001, 27701 and 42001.
Build the privacy program: RoPA, DPIAs, DSAR process, cross-border transfers (SCCs), DPAs with customers and vendors, breach notification.
Run HIPAA readiness if PHI is in scope: risk analysis, BAAs, safeguards mapping.
Stand up the ISO 42001 AI management system: AI policy, AI system inventory, AI risk and impact assessments, and controls over model and data lifecycle.
Run third-party risk management: vendor tiering, security reviews, subprocessor list.
Answer customer security questionnaires with Vanta Questionnaire Automation and run the Vanta Trust Center; maintain the answer library and knowledge base.
Run policy training, tabletop exercises, and BCP/DR test documentation.

Must have

6+ years in GRC, IT audit or security compliance, 2+ of them in-house at a SaaS or cloud company.
Led at least one SOC 2 Type II audit and one ISO 27001 certification from start to finish.
Working knowledge of GDPR and ISO 27701; practical exposure to HIPAA.
Enough technical depth in AWS, GCP or Azure, IAM, logging and CI/CD to judge whether evidence is real.
Strong policy writing and the ability to explain controls to engineers in plain terms.
Comfortable working alone and pushing work across teams without authority.

Good to have

Certifications: ISO 27001 Lead Implementer or Lead Auditor, CISA, CISM, CIPP/E or CIPM, ISO 42001 Lead Implementer, CRISC.
Exposure to ISO 42001, the EU AI Act or the NIST AI RMF.
Background in a Big Four or audit firm plus in-house experience.
Experience with Indian DPDP Act requirements.

About the Company

TrueFoundry

Enterprise AI gateway and deployment platform

TrueFoundry provides an Enterprise Platform as a Service to build, ship, and govern Agentic AI applications at scale with its AI Gateway and Agentic Deployment platform. The AI Gateway combines LLM, MCP, and Agent Gateways to give a single control plane for managing, observing, and governing all components of Gen AI apps with FinOps controls. The Agentic Deployment platform runs on Kubernetes-native infrastructure to deploy models on GPUs, run AI agents, and host MCP servers, with on-prem, multi-cloud, or hybrid options and data residency plus enterprise compliance. Its goal is to be the central control plane for Agentic AI at scale within enterprises, enabling multi-agent systems to form a self-sustaining ecosystem that speeds innovation.

Company size: 51-200
Company stage: Series A
Total funding: $21.3M
Headquarters: San Francisco, CA
Founded: 2021

Recently Posted Jobs

Explore more opportunities at TrueFoundry

See more jobs