About the role
Finance teams hand Phyto Nex AI some of the most sensitive data in their company: every receipt, every card transaction, every employee name and home address that appears on a hotel folio. Our customers' security teams know it, and so do we. A single compliance gap or careless log line could undo years of trust.
You will join a small security team reporting to our CISO and own large parts of our control environment. That includes evidence automation for SOC 2 Type II and ISO/IEC 27001:2022, PAN and PII masking verification, cloud security posture across AWS us-east-1 and ap-south-1, and the technical answers inside 30+ security questionnaires we receive each quarter.
You will report to Arvind and work with one other security engineer and an external virtual SOC. Security here is part of how we sell: controllers will not connect their expense platform until their CISO approves, and our trust center is often the first page a buyer's security team opens. You will have real influence on architecture decisions, from how we pin tenant data to a region to how the drafting service receives only masked findings. We favor controls as code, short written risk assessments and fixing root causes over adding another spreadsheet.
What you will do
- Own automated evidence collection for SOC 2 Type II and ISO 27001 controls and prepare for annual audits.
- Harden AWS infrastructure across both residency regions, including IAM boundaries, KMS policies and network segmentation.
- Build and test PAN and PII masking controls, and verify that no unmasked card numbers reach logs or model inputs.
- Run vulnerability management, coordinate twice-yearly penetration tests and track remediation to closure.
- Lead technical responses to customer security reviews, CAIQ updates and trust center content.
- Contribute to incident response playbooks and run tabletop exercises each quarter.
What you bring
- 4+ years in cloud security, security engineering or GRC engineering at a SaaS company.
- Deep AWS security knowledge: IAM, KMS, GuardDuty, Security Hub, CloudTrail.
- Experience operating SOC 2 Type II or ISO 27001 programs, ideally with compliance automation tooling.
- Ability to write code (Python, Go or TypeScript) to automate controls instead of screenshots.
- Clear communicator who can explain risk to engineers and customers alike.
Nice to have
- PCI DSS experience, especially around tokenization and masking.
- Familiarity with India DPDP Act 2023 and GDPR processor obligations.
- Certifications such as AWS Security Specialty, CISSP or OSCP.
Your first 90 days
First 30 days
Map our control set end to end and close two open findings from the last penetration test.
By day 60
Automate evidence for access reviews and change management, removing manual screenshots.
By day 90
Own the next SOC 2 Type II audit window kickoff and publish the updated CAIQ.