Careers at SecureRoot Risk Advisory

What you will do

• Build and maintain target lists of fintech, healthcare, SaaS and e-commerce companies in India, with the regulator that binds each one and the person who owns security and compliance there.
• Research an account before anyone contacts it: what it runs, what it has published about security, which certifications it claims, and what a buyer there is likely to need next.
• Draft first-contact emails and LinkedIn notes in plain language, grounded in that research, for a consultant to review before anything is sent.
• Log every conversation and date every next step in the pipeline, so the record is something the team can rely on rather than reconstruct.
• Prepare a one-page brief before each scoping call, so the consultant walks in already knowing the account.
• Track which messages get replies and which do not, and report the pattern each week with a recommendation.

What we are looking for

• A degree in progress or recently completed, in any discipline.
• Clear written English: you can explain in three sentences why a company should care about a security assessment, without a buzzword.
• Curiosity about how businesses are regulated, and the patience to read a privacy notice, an annual report or a tender to find the answer.
• Comfort with spreadsheets and a CRM, or the willingness to learn one in the first week.
• You can be at the Greater Noida West office on working days.

Useful, not required

• Any exposure to B2B sales, consulting or market research, including student projects.
• A working knowledge of what ISO 27001, SOC 2, PCI DSS or the DPDP Act are for.
• Hindi, for conversations with prospects who prefer it.

What you will do

• Answer inbound enquiries the same working day, ask the five questions that establish scope, deadline and budget, and book the scoping call with the right practice lead.
• Follow up on proposals that have gone quiet, and record what the prospect said so no consultant has to ask twice.
• Keep the lead inbox and the pipeline consistent: one record per enquiry, one owner, one dated next step.
• Send a prospect the indicative pricing page and the service pages they should read before the call, and confirm they arrived.
• Report weekly on enquiries received, calls booked, proposals outstanding and where each one stalled.
• Flag the enquiry that is really an incident, and route it to a consultant immediately rather than into the sales queue.

What we are looking for

• A degree in progress or recently completed, in any discipline.
• Spoken and written English that is clear and courteous on a first call with a CTO or a compliance head.
• Organised by habit: you notice when a follow-up date has passed before anyone else does.
• Comfort with email, a CRM and a shared calendar as everyday tools.
• You can be at the Greater Noida West office on working days.

Useful, not required

• Any customer-facing experience, including retail, support or campus roles.
• Hindi, for calls with prospects who prefer it.
• A basic understanding of what a penetration test and a compliance audit each involve.

What you will do

• Run reconnaissance and scanning under supervision, and triage the output so a senior tester spends time on what matters.
• Reproduce findings by hand, capture evidence, and write each one up with impact, exact steps and a fix a developer can follow.
• Assist on retests, confirming that a fix actually closes the finding rather than hides it from the scanner.
• Keep the engagement's evidence folder and findings tracker complete and current, so the report can be assembled without a hunt.
• Learn the practice's methodology for web, API, mobile and network testing and the OWASP material it rests on.
• Stay inside the agreed scope and rules of engagement on every test, and ask before touching anything that is not clearly in them.

What we are looking for

• A degree in progress or recently completed in computer science, IT, security or a related field, or equivalent self-taught ability you can show.
• Working knowledge of HTTP, web application architecture and the OWASP Top 10, with lab or CTF work you can talk through in detail.
• Familiarity with Linux, Burp Suite or an equivalent intercepting proxy, and Nmap.
• The judgement to stop and ask when unsure, every time; a tester who guesses at scope does not stay a tester.
• You can be at the Greater Noida West office on working days.

Useful, not required

• Hack The Box, TryHackMe, PortSwigger Web Security Academy or similar progress.
• Scripting in Python or Bash.
• A CVE, a bug bounty report or a published write-up, however small.
• Any exposure to API or mobile testing beyond the web.

What you will do

• Map a client's existing controls to ISO 27001 Annex A, the SOC 2 Trust Services Criteria or PCI DSS requirements, and record each gap with what closing it would take.
• Collect and organise evidence against the control set, and chase what is missing before the auditor does.
• Draft policies, procedures, the Statement of Applicability and DPDP Act registers from the practice's templates, for a consultant to review.
• Support readiness assessments and internal audits: scheduling, note-taking, and writing up nonconformities a manager can understand.
• Keep the engagement tracker current, so the client always knows what is done, what is next and who owns it.
• Learn how the four products the firm builds, TrustGrid and DPDPA Autopilot in particular, are used to run a programme.

What we are looking for

• A degree in progress or recently completed, in any discipline; law, commerce, IT and management are all common routes in.
• Careful reading and plain writing: you can turn a clause of a standard into a sentence a manager understands.
• A basic understanding of what an information security management system is and why an auditor asks for evidence rather than assurance.
• Comfort with documents, spreadsheets and keeping versions of both straight.
• You can be at the Greater Noida West office on working days.

Useful, not required

• Coursework or self-study in ISO 27001, SOC 2, PCI DSS, GDPR or the DPDP Act.
• Any audit, legal or compliance exposure, including academic projects or a moot.
• An ISO 27001 Foundation or similar entry-level certificate; none is required.