Compliance Analyst

Listing expiry: 24 October 2026

About the role

Role Overview

The Compliance Analyst supports IT compliance, information security governance, and regulatory readiness across ISO/IEC 27001:2022, SOC 2 Type II, HIPAA, PCI DSS, and GDPR. The role involves maintaining compliance documentation and internal controls, supporting audits, reviewing departmental Standard Operating Procedures (SOPs), identifying compliance gaps, coordinating corrective actions, and working with cross-functional teams to strengthen organizational compliance.

Key Responsibilities

• Support the development, implementation, and maintenance of compliance programs and controls covering ISO/IEC 27001:2022, SOC 2 Type II, HIPAA, PCI DSS, GDPR, and other applicable requirements.
• Create, review, organize, and maintain policies, procedures, SOPs, standards, control records, and audit-ready evidence.
• Assist with periodic internal compliance reviews, control testing, risk assessments, gap identification, and remediation planning.
• Coordinate evidence collection, documentation, auditor requests, and follow-up activities for internal and external audits and assessments.
• Record audit findings, maintain action trackers, follow up with control owners, and verify completion of corrective and preventive actions.
• Plan and assist with SOP reviews across IT, HR, Operations, Finance, Sales, Marketing, and other departments, checking that documented processes are accurate, current, and followed.
• Help teams draft, revise, standardize, and implement SOPs, documenting gaps, inefficiencies, and opportunities for process improvement.
• Prepare audit summaries, compliance status reports, risk observations, and written recommendations for relevant stakeholders.
• Collaborate with department heads and cross-functional teams to gather requirements, maintain documentation, and communicate findings and progress.
• Assist with compliance awareness and training initiatives and ongoing monitoring of internal policies, standards, and regulatory requirements.
• Use or learn GRC platforms such as Drata, Vanta, or equivalent tools to maintain control evidence, tasks, and compliance records.

Qualifications & Experience

• Foundational understanding of information security compliance, internal controls, risk management, and audit processes.
• Working knowledge of ISO 27001 and familiarity with frameworks such as SOC 2 Type II, HIPAA, PCI DSS, or GDPR.
• Ability to draft and review SOPs, policies, audit reports, checklists, and compliance evidence with strong attention to detail.
• Ability to identify gaps, track remediation items, and coordinate deliverables across multiple departments.
• Strong written and verbal communication, analytical thinking, organizational skills, and proficiency in MS Office.
• Hands-on experience with Drata, Vanta, or another governance, risk, and compliance (GRC) tool is desirable.
• Exposure to ISO 27001, SOC 2, HIPAA, PCI DSS, or GDPR audit preparation, evidence collection, or control implementation is desirable.
• Awareness of the EU AI Act, ISO/IEC 42001, and other AI governance or regulatory frameworks is desirable.
• Basic understanding of IT infrastructure, databases, networking, and data-protection practices is desirable.
• 1–2 years of experience in compliance, information security governance, internal audit, risk management, SOP auditing, or a closely related area.
• A bachelor's degree in IT, Information Security, Business, Law, or a relevant discipline is preferred.
• Relevant certifications or training in information security auditing, ISO 27001, or compliance are advantageous but not mandatory.

Additional Details

• The stated working hours are 10:00 a.m. to 8:00 p.m. IST.
• The role is based in Mohali and requires working from the office.