Governance, Risk & Compliance
GRC Intern
Support ISO 27001 compliance for our vCISO team, from documentation and evidence collection through audit reporting.
About the role
As a GRC Intern in our vCISO team, you’ll support our ISO 27001 information security program by keeping documentation current, collecting audit evidence, and pulling together data for security reports. You’ll work closely with senior team members, learning how ISO 27001 controls, security operations, and audits work in practice.
What you’ll do
-Update and maintain information security policies, procedures, and the ISMS documentation library (version control, approvals) -Help maintain risk registers, asset inventories, and vendor/third-party inventories -Collect and organize evidence for access reviews, patch reviews, vulnerability tracking, and backup/restore checks -Gather data from security tools (XDR, DLP, MDM, firewalls) and ITSM systems for the monthly Security Posture Report and Monthly Work Progress Report -Support internal audits and track CAPA (Corrective and Preventive Action) evidence and closure status -Prepare inputs and notes for Management Review Meetings and incident response tabletop exercises -Create weekly information security awareness posters and assist with policy rollout and acknowledgment tracking -Draft and update SOPs and playbooks for GRC processes -Share weekly activity summaries with your manager and coordinate with IT and Infra teams for data and evidence
What we’re looking for
-Academic or foundational understanding of information security, risk management, and compliance concepts -Basic awareness of ISO 27001 and the NIST Cybersecurity Framework Basic understanding of patch management, vulnerability management, backups, and access control (user and privileged access reviews) Strong attention to detail and a structured way of working, especially with documentation and records -Clear written and verbal communication -Ability to handle multiple tasks at once and a willingness to learn and adapt -Comfort working under close supervision and taking feedback
Nice to have
-ISO 27001 Lead Implementer or Lead Auditor certification (or coursework toward it) -Working knowledge of Microsoft Word and Excel, including macros or basic automation -Exposure to third-party/vendor risk assessments -Familiarity with network security and firewall concepts -Understanding of incident management, business continuity (BCP/BIA), or ISO 22301 -Awareness of data privacy principles, India’s DPDPA, or SEBI CSCRF -Familiarity with Privacy Impact Assessments or AI governance frameworks