Careers at SecureRoot Risk Advisory

What you will do

• Build and maintain target lists of fintech, healthcare, SaaS and e-commerce companies in India, with the regulator that binds each one and the person who owns security and compliance there.
• Research an account before anyone contacts it: what it runs, what it has published about security, which certifications it claims, and what a buyer there is likely to need next.
• Draft first-contact emails and LinkedIn notes in plain language, grounded in that research, for a consultant to review before anything is sent.
• Log every conversation and date every next step in the pipeline, so the record is something the team can rely on rather than reconstruct.
• Prepare a one-page brief before each scoping call, so the consultant walks in already knowing the account.
• Track which messages get replies and which do not, and report the pattern each week with a recommendation.

What we are looking for

• A degree in progress or recently completed, in any discipline.
• Clear written English: you can explain in three sentences why a company should care about a security assessment, without a buzzword.
• Curiosity about how businesses are regulated, and the patience to read a privacy notice, an annual report or a tender to find the answer.
• Comfort with spreadsheets and a CRM, or the willingness to learn one in the first week.
• You can be at the Greater Noida West office on working days.

Useful, not required

• Any exposure to B2B sales, consulting or market research, including student projects.
• A working knowledge of what ISO 27001, SOC 2, PCI DSS or the DPDP Act are for.
• Hindi, for conversations with prospects who prefer it.

What you will do

• Answer inbound enquiries the same working day, ask the five questions that establish scope, deadline and budget, and book the scoping call with the right practice lead.
• Follow up on proposals that have gone quiet, and record what the prospect said so no consultant has to ask twice.
• Keep the lead inbox and the pipeline consistent: one record per enquiry, one owner, one dated next step.
• Send a prospect the indicative pricing page and the service pages they should read before the call, and confirm they arrived.
• Report weekly on enquiries received, calls booked, proposals outstanding and where each one stalled.
• Flag the enquiry that is really an incident, and route it to a consultant immediately rather than into the sales queue.

What we are looking for

• A degree in progress or recently completed, in any discipline.
• Spoken and written English that is clear and courteous on a first call with a CTO or a compliance head.
• Organised by habit: you notice when a follow-up date has passed before anyone else does.
• Comfort with email, a CRM and a shared calendar as everyday tools.
• You can be at the Greater Noida West office on working days.

Useful, not required

• Any customer-facing experience, including retail, support or campus roles.
• Hindi, for calls with prospects who prefer it.
• A basic understanding of what a penetration test and a compliance audit each involve.

What you will do

• Run reconnaissance and scanning under supervision, and triage the output so a senior tester spends time on what matters.
• Reproduce findings by hand, capture evidence, and write each one up with impact, exact steps and a fix a developer can follow.
• Assist on retests, confirming that a fix actually closes the finding rather than hides it from the scanner.
• Keep the engagement's evidence folder and findings tracker complete and current, so the report can be assembled without a hunt.
• Learn the practice's methodology for web, API, mobile and network testing and the OWASP material it rests on.
• Stay inside the agreed scope and rules of engagement on every test, and ask before touching anything that is not clearly in them.

What we are looking for

• A degree in progress or recently completed in computer science, IT, security or a related field, or equivalent self-taught ability you can show.
• Working knowledge of HTTP, web application architecture and the OWASP Top 10, with lab or CTF work you can talk through in detail.
• Familiarity with Linux, Burp Suite or an equivalent intercepting proxy, and Nmap.
• The judgement to stop and ask when unsure, every time; a tester who guesses at scope does not stay a tester.
• You can be at the Greater Noida West office on working days.

Useful, not required

• Hack The Box, TryHackMe, PortSwigger Web Security Academy or similar progress.
• Scripting in Python or Bash.
• A CVE, a bug bounty report or a published write-up, however small.
• Any exposure to API or mobile testing beyond the web.

What you will do

• Map a client's existing controls to ISO 27001 Annex A, the SOC 2 Trust Services Criteria or PCI DSS requirements, and record each gap with what closing it would take.
• Collect and organise evidence against the control set, and chase what is missing before the auditor does.
• Draft policies, procedures, the Statement of Applicability and DPDP Act registers from the practice's templates, for a consultant to review.
• Support readiness assessments and internal audits: scheduling, note-taking, and writing up nonconformities a manager can understand.
• Keep the engagement tracker current, so the client always knows what is done, what is next and who owns it.
• Learn how the four products the firm builds, TrustGrid and DPDPA Autopilot in particular, are used to run a programme.

What we are looking for

• A degree in progress or recently completed, in any discipline; law, commerce, IT and management are all common routes in.
• Careful reading and plain writing: you can turn a clause of a standard into a sentence a manager understands.
• A basic understanding of what an information security management system is and why an auditor asks for evidence rather than assurance.
• Comfort with documents, spreadsheets and keeping versions of both straight.
• You can be at the Greater Noida West office on working days.

Useful, not required

• Coursework or self-study in ISO 27001, SOC 2, PCI DSS, GDPR or the DPDP Act.
• Any audit, legal or compliance exposure, including academic projects or a moot.
• An ISO 27001 Foundation or similar entry-level certificate; none is required.

What you will do

• Coordinate hiring end to end: post roles, track applications in the shared folder, schedule calls and exercises with practice leads, and keep every candidate informed either way.
• Run onboarding for new joiners: paperwork, accounts and access requests, the first-week plan, and the introductions that make a new consultant useful quickly.
• Keep personnel records complete, current and confidential, including leave, attendance and the documents an auditor or a client questionnaire may ask about.
• Draft and maintain HR policies and templates with the leadership, in plain language, and make sure people can actually find them.
• Support engagement and learning: training calendars, certification tracking, internal sessions and feedback rounds.
• Handle day-to-day people queries at the Greater Noida West office, and escalate what needs a decision.

What we are looking for

• A degree in progress or recently completed in HR, management, psychology, commerce or a related field.
• Discretion by default: you understand that personnel data is confidential, and why a security consultancy holds itself to that first.
• Clear, courteous written and spoken English; Hindi is useful for day-to-day conversations.
• Organised and reliable with calendars, documents and spreadsheets, and comfortable chasing people politely.
• You can be at the Greater Noida West office on working days.

Useful, not required

• Any exposure to recruiting, campus placement work or an HR internship.
• Familiarity with a hiring or HR tool, or the willingness to set one up.
• A basic understanding of the DPDP Act as it applies to employee data; the firm will teach the rest.