On-site opportunity at
MeeshoAssociate Compliance Manager
The position is a practical, individual-contributor role in the Security and Compliance group at Meesho, an e-commerce platform based in Bengaluru. The person drives a compliance…
Career Tools
About This Role
The position is a practical, individual-contributor role in the Security and Compliance group at Meesho, an e-commerce platform based in Bengaluru. The person drives a compliance program that spans several frameworks at once, rather than only supervising others. The group maintains the company's information security management system, leads external certifications, and works to keep sellers, buyers, partners and regulators confident in the platform. Most of the effort goes into running…
Job Description
The position is a practical, individual-contributor role in the Security and Compliance group at Meesho, an e-commerce platform based in Bengaluru. The person drives a compliance program that spans several frameworks at once, rather than only supervising others. The group maintains the company's information security management system, leads external certifications, and works to keep sellers, buyers, partners and regulators confident in the platform.
Most of the effort goes into running certification and audit cycles from beginning to end. That covers readiness assessments, closing gaps, gathering evidence, preparing management responses and keeping audit calendars and evidence stores up to date. The person is the first point of contact for outside auditors and works with the engineering, IT, legal and product groups so that controls run as intended.
The role also reaches into third-party risk, internal controls and privacy. Duties include testing access, change and operations controls, managing vendors across their full lifecycle, and helping apply India's data protection rules day to day, such as impact assessments, consent flows and breach notification steps. It suits a compliance or audit professional who has delivered certifications before and writes clearly for senior leadership.
Responsibilities
- Lead the ISO 27001:2022 and SOC 2 Type II certification and surveillance cycles, acting as the main contact for external auditors
- Keep the information security management system current, with named control owners and up-to-date evidence
- Design, test and improve IT general controls covering access, change, IT operations and the software development lifecycle
- Run third-party risk reviews from vendor intake and tiering through security checks, contract terms, monitoring and offboarding
- Maintain the enterprise risk register, define risk indicators and drive treatment plans with leadership
- Coordinate privacy compliance under the DPDP Act and Rules, including impact assessments and records of processing
- Support business continuity and disaster recovery testing aligned to ISO 22301
- Answer customer and partner security questionnaires and keep trust center material current
- Run security and privacy awareness training, including phishing simulations
Requirements
- Four to six years of GRC, IT audit or security compliance experience at a product business such as a SaaS, fintech, e-commerce or payments company
- Hands-on experience taking ISO 27001:2022 from gap analysis through implementation, certification and surveillance
- Practical record of running a SOC 2 Type II engagement and handling the auditor
- Strong experience designing and testing IT general controls and running a complete third-party risk program
- Working knowledge of AWS or GCP, including the shared responsibility model and native tools used to collect audit evidence
- Ability to manage relationships with internal functions and outside auditors alike
- Clear writing for policy documents, audit answers and risk reports aimed at executives
Qualifications
- Experience implementing the DPDP Act 2023 and DPDP Rules 2025 would help, as would knowledge of GDPR or ISO 27701
- Hands-on use of a GRC platform such as Sprinto, Vanta, Drata, OneTrust, AuditBoard, MetricStream, ServiceNow GRC or Archer
- ISO 22301 business continuity experience, exposure to RBI, SEBI or IRDAI sector rules, or PCI DSS v4.0.1 experience
- Certifications named in the posting: ISO 27001:2022 Lead Auditor or Lead Implementer, CISA, and CIPP/E or DCPP
Core Skills
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
Is this role remote or on-site?
The listing shows an on-site, full-time role in Bengaluru. The posting does not mention remote or hybrid working.
How much experience does the role require?
The posting asks for four to six years of GRC, IT audit or security compliance experience at a product company.
Which certifications are relevant?
The posting names ISO 27001:2022 Lead Auditor or Lead Implementer, CISA, and CIPP/E or DCPP. It does not say whether these are required.
Does the posting state a salary?
No. The posting does not specify a salary.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.