Job Description & How to Apply Below
GRC engineer is a combination of two prime areas. One is regulatory and compliance depth frameworks, control design and testing, audit judgement, deviations, the Indian financial-sector stack. The other is AI-native practice assessing AI and LLM systems for compliance risk, evaluating AI tools and vendors before they are onboarded, using AI for the mechanical half of the work with validation as a reflex, and directing AI tooling to build the monitoring and evidence automation the function needs.
Razorpay operates under one of the densest regulatory stacks in Indian technology the DPDP Act 2023, RBI Payment Aggregator and Payment Gateway directions, the PPI Master Directions, RBI Digital Payment Security Controls and Cyber Security Framework expectations, PCI DSS v4.x, ISO 27001 and 27701, and SOC 2 simultaneously, not sequentially. Doing this by hand does not scale to our velocity. AI handles the high volume, repetitive work: evidence collection and summarisation, control cross walking, drafting test procedures, parsing audit logs, first-pass alert triage, questionnaire response.
It is treated like a fast junior analyst whose output is always reviewed.
Key Responsibilities
Own the end-to-end control lifecycle : design, implementation, testing, evidence, and audit readiness
Drive risk assessments, audit findings (deviations), and remediation closure with clear ownership
Review cloud security (AWS/GCP), IAM, application security, and data protection controls in production systems
Evaluate and govern AI/LLM systems, tools, and vendors for data security, privacy, and compliance risks
Build automation-first GRC systems : continuous monitoring, evidence pipelines, and control validation frameworks
Support and lead regulatory audits (RBI, ISO 27001, SOC 2, PCI DSS) with production-backed evidence
Partner with engineering to embed controls into architecture and SDLC (policy-as-code mindset)
Own third-party/vendor risk assessments with a strong technical lens
What We’re Looking For
4+ years of experience in GRC, IT audit, security, or compliance engineering
Strong hands-on expertise in security and compliance frameworks (ISO 27001, SOC 2, PCI DSS, ITGC, DPDP)
Solid understanding of cloud security, IAM, secure SDLC, and data protection controls
Proven experience in risk management, audit handling, and control testing
Exposure to AI/LLM risk, data governance, and vendor security assessments
Ability to translate deep technical findings into business risk and actionable insights
Preferred
Experience in fintech or regulated environments (RBI, payments, banking)
Hands-on with GRC tools (Vanta, Drata, Secureframe) or compliance automation systems
Familiarity with automation, scripting, APIs, or policy-as-code approaches
Experience building monitoring, evidence collection, or compliance pipelines
Why This Role
Work on AI + Compliance + Engineering convergence
Build scalable, automation-first GRC systems instead of manual audit workflows
High ownership role influencing security posture and regulatory strategy
Opportunity to set the technical bar for GRC engineering
Position Requirements
10+ Years
work experience
To View & Apply for jobs on this site that accept applications from your location or country, tap the button below to make a Search.
(If this job is in fact in your jurisdiction, then you may be using a Proxy or VPN to access this site, and to progress further, you should change your connectivity to another mobile device or PC).
(If this job is in fact in your jurisdiction, then you may be using a Proxy or VPN to access this site, and to progress further, you should change your connectivity to another mobile device or PC).
Search for further Jobs Here:
×