Own and advance Vegapay’s security program across application, cloud, operations, and compliance. Lead VAPT and secure design reviews, harden cloud and container environments, operate detection and incident response, and support PCI DSS, ISO 27001, SOC 2, and other audits. Mentor security staff, establish technical standards, review architectures and code, manage security risks, and partner with engineering, product, and regulated financial-services stakeholders.
The Impact You’ll Drive
We're looking for an experienced GRC professional to build and scale our governance, risk, and compliance function. As a fintech infrastructure provider processing sensitive financial data on behalf of banks and NBFCs, we operate under significant regulatory scrutiny - this role will own the frameworks, certifications, and controls that keep Vegapay compliant, secure, and trusted by our regulated BFSI partners. You’ll work closely with Security, Engineering, Legal, Product, and leadership to embed governance and risk management into how we build and operate, while being the primary point of contact for client and auditor assurance.
The Hats You Will Wear
Governance & Policy Management
- Design, implement, and maintain information security and compliance policies, standards, and procedures aligned to ISO 27001, SOC 2, PCI-DSS, and RBI guidelines
- Establish and run governance forums (risk council, policy reviews) with leadership and cross-functional stakeholders
- Own and maintain the organization’s risk register, control framework, and compliance calendar
- Conduct periodic enterprise and IT risk assessments, identifying gaps and driving remediation with process and engineering owners
- Define and track key risk indicators (KRIs) and key control indicators (KCIs) across the business
- Support risk-based decision-making for new products, partnerships, and vendor relationships
Risk Management
- Ensure ongoing compliance with RBI guidelines, payment ecosystem regulations (NPCI, card network mandates), and data protection requirements including the DPDPA
- Track regulatory and industry changes impacting fintech/BFSI operations and translate them into actionable requirements
- Liaise with regulators, external auditors, and banking/NBFC partners on compliance matters as needed
- Own and coordinate RBI-related audits and regulatory inspections, including evidence submission, query resolution, and remediation tracking
Information Security Compliance & Audits
- Own end-to-end delivery of ISO 27001, SOC 2 Type II, PCI-DSS, and other certification audits — including evidence collection, auditor coordination, and remediation tracking
- Partner with Engineering and Security to embed controls into product and infrastructure design
- Drive closure of audit findings and monitor control effectiveness over time
Vendor & Third-Party Risk Management
- Design and operate a vendor/third-party risk assessment program covering onboarding due diligence, periodic reviews, and offboarding
- Review vendor contracts and SLAs for risk, security, and compliance clauses in partnership with Legal
Client & Stakeholder Assurance
- Respond to security and compliance due-diligence questionnaires and audits from banking and NBFC clients
- Represent Vegapay’s GRC posture in client and partner conversations, building trust with regulated BFSI customers
- Prepare compliance dashboards, risk reports, and leadership/board updates
The Perfect Fit
- Bachelor’s degree in Engineering, Technology, Business, or a related field; advanced degree is a plus
- 6–8 years of experience in Governance, Risk & Compliance, Information Security Compliance, IT Audit, or related roles — preferably within fintech, BFSI, SaaS, or payments
- Hands-on experience implementing and managing ISO 27001, SOC 2, and PCI-DSS programs, including leading external audits to closure
- Working knowledge of RBI regulations, payment ecosystem guidelines, and data protection laws (DPDPA/GDPR)
- Experience building and operating vendor/third-party risk management programs
- Strong stakeholder management skills, with the ability to work across Security, Engineering, Legal, and business teams
- Excellent written and verbal communication skills, including policy writing and executive-level reporting
Your Edge Over the Rest
- Professional certifications such as CISA, CRISC, CISSP, CISM, or ISO 27001 Lead Auditor/Implementer
- Prior experience in a regulated financial services, payments, or banking technology environment
- Exposure to cloud security governance (AWS/GCP) and DevSecOps practices
- Experience setting up or scaling a GRC function from the ground up in a startup environment
- Familiarity with GRC tooling and compliance automation platforms
The Problem We’re Solving
Financial institutions today are held back by legacy systems that are slow, rigid, and expensive to scale. Launching or evolving credit, lending, and UPI products often takes months, requires heavy engineering effort, and limits the ability to create personalized customer experiences.
At the same time, customer expectations have changed - speed, flexibility, and tailored financial products are no longer optional. Banks and fintechs need infrastructure that allows them to innovate quickly, adapt continuously, and scale without friction.
This is where we come in.
At Vegapay, we are building modern, configurable fintech infrastructure that enables banks, NBFCs, and enterprises to design, launch, and manage credit and payment programs with ease. Our platform brings together flexibility, speed, and control - helping our partners unlock new growth opportunities and deliver personalized banking experiences at scale.
The Opportunity Ahead
- Lead and shape high-impact engineering teams building real-world fintech infrastructure
- Drive both technical direction and team growth - with real ownership and decision-making authority
- Work on complex, scalable systems that directly power banking, credit, and payments
- Collaborate with strong product and leadership teams in a fast-moving, execution-first environment
Vegapay Technology Private Limited Bengaluru, Karnataka, IND Office
Bengaluru, India
Similar Jobs
Fintech • Financial Services
Leads software engineering initiatives focused on generative AI. Designs, codes, tests, debugs, documents, and deploys complex technology solutions while guiding less experienced engineers. Develops AI and machine learning applications, including RAG pipelines, model training, tuning, microservices, cloud infrastructure, integrations, CI/CD, observability, and DevOps practices. Collaborates with technical stakeholders, resolves complex issues, supports enterprise risk and compliance requirements, and evaluates emerging technologies through proofs of concept.
Top Skills:
AjaxAngularAnsibleSparkAWSAzureDatadogDevOpsElk StackGoogle Cloud Platform (Gcp)GrafanaHadoopHarnessInfrastructure As CodeJavaScriptJenkinsJqueryLangchainLanggraphLarge Language Models (Llms)MicroservicesPrometheusPythonPyTorchReactRestRetrieval-Augmented Generation (Rag)ServicenowSoapTensorFlowTest-Driven DevelopmentVector Databases
Fintech • Financial Services
Supports institutional investment operations through trade processing, transaction reconciliation, inquiry research, exception resolution, documentation review, and operational issue management. Maintains risk, audit, compliance, and control requirements; recommends process improvements; participates in initiatives; and guides less experienced team members. Collaborates with internal and external stakeholders to deliver accurate, timely services. Requires at least two years of institutional investment operations experience and availability for a 5:30 PM to 2:30 AM shift.
Fintech • Financial Services
Develop, test, debug, document, upgrade, and deploy Java full-stack applications and microservices. Improve service quality and availability, evaluate technology solutions, resolve technical issues, and support security and compliance requirements. The role requires strong experience with Java, microservices architecture, APIs, cloud and distributed systems, Angular front-end development, testing frameworks, observability tools, and modern architectural patterns. Candidates may also lead a small technical team and contribute to Scrum-based development.
Top Skills:
Ai ToolsAngularAngularjsApigeeAppdynamicsAWSBootstrapCucumberDistributed LoggingDistributed TracingDomain-Driven DesignElk StackFongoGitGradleJ2EeJavaJunitKafkaMicroservicesMockitoMongoDBPcfPrimengRdbmsService DiscoveryService MeshSplunkSpring Cloud GatewayTestng
What you need to know about the Bengaluru Tech Scene
Dubbed the "Silicon Valley of India," Bengaluru has emerged as the nation's leading hub for information technology and a go-to destination for startups. Home to tech giants like ISRO, Infosys, Wipro and HAL, the city attracts and cultivates a rich pool of tech talent, supported by numerous educational and research institutions including the Indian Institute of Science, Bangalore Institute of Technology, and the International Institute of Information Technology.
