Corporate Risk and Compliance - Associate II

Responsibilities:

Endpoint & Identity Security: Assess and regulate/optimize Microsoft Entra ID (Conditional Access, Identity Protection) and Intune MDM /MAM to manage configuration and compliance profiles for both Windows and macOS environments. Investigate security timelines using Microsoft Defender for Endpoint.

Network Security: Assess, monitor, regulate and audit perimeter and infrastructure security controls across a multi-vendor environment, including Next-Gen Firewalls (Fortinet/SonicWall/Check Point/Cisco) and enterprise wireless architectures (Aruba Wi-Fi).

Email Security & Gateway Security: Assess, monitor, regulate and audit enterprise email security gateways and protection suites (e.g., Defender for MS365 ,). Manage anti-phishing, anti-spam, and safe attachments policies, and maintain foundational authentication protocols including SPF , DKIM , and DMARC .

Data Protection & DLP : Tune and monitor Endpoint and Network Data Loss Prevention ( DLP ) policies, analyzing data flows to prevent unauthorized exposure of proprietary or regulated data.

Cloud Security Governance: Govern and enforce security best practices across AWS and Azure. Monitor security posture ( CSPM ), audit IAM configurations, and secure cloud storage.

GRC Alignment & Audit Support: Map everyday technical configurations to ISO 27001 and PCI-DSS controls. Systematically gather and organize log/configuration evidence for internal and external auditors.

R&C Business Support: Act as the Risk & Compliance guardian for the business; review, evaluate, and respond to incoming IT tickets, change requests, and end-user security queries to ensure no unauthorized risks are introduced.

Cross-Functional Collaboration: Act as the security bridge to Helpdesk, Infrastructure, DevOps, and Business teams. Translate technical risks into clear, actionable business language to drive fixes.

Action Item Tracking: Meticulously track open vulnerabilities, audit gaps, and risk exceptions. Own the follow-up lifecycle to ensure internal teams resolve items within agreed SLAs.

Skills:

Microsoft Stack: Strong understanding of M365 product/security suites, Intune deployments, and hybrid identity environments.

Networking & Perimeter Security: Strong understanding of networking technologies, network security, enterprise firewalls, and secure perimeter controls.

Email Protocols & Infrastructure: Strong working knowledge of email security infrastructure, mail routing, and authentication standards ( SPF , DKIM , DMARC ).

Multi-OS Mastery: Solid understanding of different operating systems, including enterprise management of Windows, Linux, and macOS environments.

Automation & Scripting: Strong understanding of developing and reviewing technical scripts using common languages (e.g., Bash/Shell, Python) to analyze logs or automate checks.

Compliance Automation: Experience automating and templating security processes, metrics, and documentation for strict compliance purposes.

Cloud Infrastructure: Solid understanding of public cloud technologies with hands-on technical knowledge of at least one major public cloud platform (AWS or Azure).

Security Fundamentals: Comprehensive understanding and hands-on for Vulnerability Assessments, Penetration Testing concepts, Identity & Access Management (IAM), and Endpoint Security.

Frameworks & Process: Practical understanding of IT security frameworks, controls, and auditing processes—including CIS , NIST , PCI-DSS, and SOC 1/2.

Documentation & Audit Support: Ability to author clear Standard Operating Procedures (SOPs) and systematically manage compliance evidence collection.

Emerging Tech & AI: Basic understanding of AI tools and technologies, including their safe implementation and associated risk factors.

Experience and Qualifications:

3+ years of experience in Information Security, Risk & Compliance, Endpoint Security, Network Security or Technical GRC role.

Bachelor of Technology (BE/ B.Tech ) in Computer Science or equivalent.

Certifications (At least one of the following or equivalent is required):

Identity & Cloud Security: Microsoft Certified Associate (SC-200, SC-300, or SC-900).

Security Fundamentals: ISC ² CC (Certified in Cybersecurity), CompTIA Security+ or CEH (Certified Ethical Hacker).

Network Security: CCNA (Cisco), Certified Security Associate (Cisco/Check Point), NSE 4 (Fortinet), or JNCIA (Juniper).