Corporate Risk and Compliance - Associate II

Responsibilities:

• Endpoint & Identity Security: Assess and regulate/optimize Microsoft Entra ID (Conditional Access, Identity Protection) and Intune MDM/MAM to manage configuration and compliance profiles for both Windows and macOS environments. Investigate security timelines using Microsoft Defender for Endpoint. 
• Network Security: Assess, monitor, regulate and audit perimeter and infrastructure security controls across a multi-vendor environment, including Next-Gen Firewalls (Fortinet/SonicWall/Check Point/Cisco) and enterprise wireless architectures (Aruba Wi-Fi). 
• Email Security & Gateway Security: Assess, monitor, regulate and audit enterprise email security gateways and protection suites (e.g., Defender for MS365,). Manage anti-phishing, anti-spam, and safe attachments policies, and maintain foundational authentication protocols including SPF, DKIM, and DMARC. 
• Data Protection & DLP: Tune and monitor Endpoint and Network Data Loss Prevention (DLP) policies, analyzing data flows to prevent unauthorized exposure of proprietary or regulated data. 
• Cloud Security Governance: Govern and enforce security best practices across AWS and Azure. Monitor security posture (CSPM), audit IAM configurations, and secure cloud storage. 
• GRC Alignment & Audit Support: Map everyday technical configurations to ISO 27001 and PCI-DSS controls. Systematically gather and organize log/configuration evidence for internal and external auditors. 
• R&C Business Support: Act as the Risk & Compliance guardian for the business; review, evaluate, and respond to incoming IT tickets, change requests, and end-user security queries to ensure no unauthorized risks are introduced. 
• Cross-Functional Collaboration: Act as the security bridge to Helpdesk, Infrastructure, DevOps, and Business teams. Translate technical risks into clear, actionable business language to drive fixes.
• Action Item Tracking: Meticulously track open vulnerabilities, audit gaps, and risk exceptions. Own the follow-up lifecycle to ensure internal teams resolve items within agreed SLAs.

Skills:

• Microsoft Stack: Strong understanding of M365 product/security suites, Intune deployments, and hybrid identity environments. 

• Networking & Perimeter Security: Strong understanding of networking technologies, network security, enterprise firewalls, and secure perimeter controls. 

• Email Protocols & Infrastructure: Strong working knowledge of email security infrastructure, mail routing, and authentication standards (SPF, DKIM, DMARC). 

• Multi-OS Mastery: Solid understanding of different operating systems, including enterprise management of Windows, Linux, and macOS environments. 

• Automation & Scripting: Strong understanding of developing and reviewing technical scripts using common languages (e.g., Bash/Shell, Python) to analyze logs or automate checks. 

• Compliance Automation: Experience automating and templating security processes, metrics, and documentation for strict compliance purposes. 

• Cloud Infrastructure: Solid understanding of public cloud technologies with hands-on technical knowledge of at least one major public cloud platform (AWS or Azure). 

• Security Fundamentals: Comprehensive understanding and hands-on for Vulnerability Assessments, Penetration Testing concepts, Identity & Access Management (IAM), and Endpoint Security. 

• Frameworks & Process: Practical understanding of IT security frameworks, controls, and auditing processes—including CIS, NIST, PCI-DSS, and SOC 1/2. 

• Documentation & Audit Support: Ability to author clear Standard Operating Procedures (SOPs) and systematically manage compliance evidence collection. 

• Emerging Tech & AI: Basic understanding of AI tools and technologies, including their safe implementation and associated risk factors. 

Experience and Qualifications:

3+ years of experience in Information Security, Risk & Compliance, Endpoint Security, Network Security or Technical GRC role. 
Bachelor of Technology (BE/B.Tech) in Computer Science or equivalent.
Certifications (At least one of the following or equivalent is required): 
Identity & Cloud Security: Microsoft Certified Associate (SC-200, SC-300, or SC-900). 
Security Fundamentals: ISC² CC (Certified in Cybersecurity), CompTIA Security+ or CEH (Certified Ethical Hacker). 
Network Security: CCNA (Cisco), Certified Security Associate (Cisco/Check Point), NSE 4 (Fortinet), or JNCIA (Juniper).