GRC Intern

About the Role

R360 maintains concurrent conformance to six major compliance frameworks ISO/IEC 27001:2022, ISO/IEC 27701, ISO/IEC 20000\-1, SOC 2, India's DPDP Act 2023, and PCI DSS v4\.0\.1 across a banking\-linked platform serving HDFC Bank, ICICI Bank, and Kotak Mahindra Bank. This paid internship gives you structured, mentored exposure to real audit cycles, evidence collection, and control\-testing work across all six frameworks a depth of multi\-framework exposure that is uncommon at entry level, under the direct supervision of senior GRC analysts.

Key Responsibilities (Under Supervision)* Assist in evidence collection for ISO 27001, ISO 27701, ISO 20000\-1, SOC 2, PCI DSS, and DPDP Act compliance activities.

• Support risk register updates and control\-testing sample pulls.
• Assist with policy and procedure documentation reviews and version control.
• Support first\-draft responses to vendor/client security questionnaires, reviewed by a senior GRC analyst before submission.
• Assist with audit logistics scheduling, evidence repository organisation, and auditor request tracking.
• Learn ROPA and DPIA basics under supervision as part of DPDP Act 2023 compliance work.
• Support security awareness training tracking and completion reporting.
• Assist with PCCB documentation review to flag compliance\-relevant changes.

Learning Outcomes* Real\-world exposure to six concurrent compliance frameworks inside a live BFSI\-adjacent environment.

• Understanding of the full audit lifecycle preparation, evidence collection, auditor coordination, and closure.
• Foundational GRC skills that map directly to a GRC Analyst career path.

Eligibility* Pursuing or recently completed a degree in Information Security, IT, Law, Business Administration, or a related field.

• Basic understanding of information security and/or data privacy concepts; relevant coursework or in\-progress certifications are a plus.
• Detail\-oriented with strong written English for documentation\-heavy work.
• GRC — Governance, Risk \& Compliance Hiring
• Genuine interest in a compliance/audit career path (as distinct from a purely technical/offensive\-security track).

Preferred (Not Mandatory)* ISO/IEC 27001 Foundation certificate, or actively pursuing one.

• Exposure to privacy law coursework (DPDP Act 2023, GDPR) is a plus.
• Comfort with Excel/Google Sheets and, ideally, some exposure to a GRC tool (ServiceNow GRC, OneTrust, Vanta, or similar).

Program Structure

1\. Month 1–2 Foundations

Framework overview across ISO 27001, ISO 27701, ISO 20000\-1, SOC 2, PCI DSS, and DPDP Act 2023; shadowing GRC analysts; tool walk throughs.

2\. Month 3–4 Guided Evidence Collection

Hands\-on evidence collection and control\-testing support, with mandatory senior review before submission.

3\. Month 5–6 Supervised Independence

Independent ownership of low\-risk documentation/evidence tasks (reviewed); capstone project — build one control\-mapping matrix or mini gap\-analysis across two frameworks.