About the Role
R360 maintains concurrent conformance to six major compliance frameworks ISO/IEC 27001:2022, ISO/IEC 27701, ISO/IEC 20000-1, SOC 2, India's DPDP Act 2023, and PCI DSS v4.0.1 across a banking-linked platform serving HDFC Bank, ICICI Bank, and Kotak Mahindra Bank. This paid internship gives you structured, mentored exposure to real audit cycles, evidence collection, and control-testing work across all six frameworks a depth of multi-framework exposure that is uncommon at entry level, under the direct supervision of senior GRC analysts.
Key Responsibilities (Under Supervision)
- Assist in evidence collection for ISO 27001, ISO 27701, ISO 20000-1, SOC 2, PCI DSS, and DPDP Act compliance activities.
- Support risk register updates and control-testing sample pulls.
- Assist with policy and procedure documentation reviews and version control.
- Support first-draft responses to vendor/client security questionnaires, reviewed by a senior GRC analyst before submission.
- Assist with audit logistics scheduling, evidence repository organisation, and auditor request tracking.
- Learn ROPA and DPIA basics under supervision as part of DPDP Act 2023 compliance work.
- Support security awareness training tracking and completion reporting.
- Assist with PCCB documentation review to flag compliance-relevant changes.
Learning Outcomes
- Real-world exposure to six concurrent compliance frameworks inside a live BFSI-adjacent environment.
- Understanding of the full audit lifecycle preparation, evidence collection, auditor coordination, and closure.
- Foundational GRC skills that map directly to a GRC Analyst career path.
Eligibility
- Pursuing or recently completed a degree in Information Security, IT, Law, Business Administration, or a related field.
- Basic understanding of information security and/or data privacy concepts; relevant coursework or in-progress certifications are a plus.
- Detail-oriented with strong written English for documentation-heavy work.
- GRC — Governance, Risk & Compliance Hiring
- Genuine interest in a compliance/audit career path (as distinct from a purely technical/offensive-security track).
Preferred (Not Mandatory)
- ISO/IEC 27001 Foundation certificate, or actively pursuing one.
- Exposure to privacy law coursework (DPDP Act 2023, GDPR) is a plus.
- Comfort with Excel/Google Sheets and, ideally, some exposure to a GRC tool (ServiceNow GRC, OneTrust, Vanta, or similar).
Program Structure
1. Month 1–2 Foundations
Framework overview across ISO 27001, ISO 27701, ISO 20000-1, SOC 2, PCI DSS, and DPDP Act 2023; shadowing GRC analysts; tool walk throughs.
2. Month 3–4 Guided Evidence Collection
Hands-on evidence collection and control-testing support, with mandatory senior review before submission.
3. Month 5–6 Supervised Independence
Independent ownership of low-risk documentation/evidence tasks (reviewed); capstone project — build one control-mapping matrix or mini gap-analysis across two frameworks.