Technical Product Owner – GRC

About CyRAACS

CyRAACS is building the next generation of intelligent, scalable systems at the intersection of robust backend engineering and cutting-edge AI. We are a fast-moving, high-trust team that ships consequential software and values deep technical ownership. Our engineers solve hard problems, influence product direction, and building the next generation of talent.

The COMPASS Advantage

COMPASS is not just a product. It is the intelligence layer our clients use to manage risk, track compliance, and make security decisions at scale. Working alongside COMPASS puts you at the intersection of cybersecurity consulting and AI-powered product thinking, a rare combination that sharpens practitioners and distinguishes careers.

Role Overview

We are seeking a Technical Product Owner – GRC to build and own the AI skills that generate the governance content behind COMPASS, and the content itself: control libraries, regulatory mappings, risk taxonomies, policy frameworks, and assessment questionnaires across our product suite. This role sits at the intersection of regulatory depth and product engineering, shaping how organisations across regulated and security-conscious sectors demonstrate compliance against both global standards and Indian regulation. As COMPASS expands from continuous compliance into risk management, policy management, third-party risk management and a compliance trust centre, this role builds the content foundation each new product depends on.

Key Responsibilities

Functional/Technical Responsibilities

• Own the COMPASS control library end to end: author control requirements, define granularity rules, and
• approve every change to the library and its supporting doctrine.
• Map regulatory instruments and certification standards onto the control library, deciding how each
• obligation is decomposed, where it homes, and why — with the rationale recorded and defensible to an
• auditor.
• Author the compliance criteria that determine whether a control is satisfied for a given standard, including the evidence each criterion requires.
• Build, test, and continuously improve the AI skills that generate and validate governance content, working with the engineering team to make quality checks deterministic and repeatable.
• Perform functional testing across platform releases, verifying that generated content behaves correctly against real client environments before it reaches production.
• Provide functional inputs into product requirements, including how content should appear to users and what the platform needs to do with it.
• Build and own the functional repositories underpinning every product in the suite — risk taxonomies and risk registers, policy frameworks and templates, third-party risk questionnaires and scoring models, and trust centre content — applying the same authoring discipline across all of them.
• Extend coverage to new standards, regulations and frameworks as they are issued or as client demand requires, including the AI skills needed to author and validate that content efficiently.
• Improve the quality of existing content on an ongoing basis: consistency of wording, specificity of the evidence demanded, and the testing method applied.

Strategic Responsibilities

• Track regulatory change across Indian and global frameworks, assess the impact on the content across all products, and propose the sequencing of work required to respond.
• Identify where governance content is generated inefficiently or reviewed at high cost and propose
• automation to close the gap.

Stakeholder Management

• Work directly with engineering and AI teams to translate governance requirements into platform behaviour, and to specify the quality checks that prove it works.
• Explain content and platform changes clearly to the engineering and AI teams who build to them, and to the CyRAACS CMS teams who use COMPASS to deliver to clients.

Governance and Quality

• Maintain a complete record of library and mapping decisions, including the reasoning behind each, so that any change can be traced and defended.
• Ensure all governance content meets CyRAACS quality standards before release, and that no change reaches production without review against the applicable rules.

Key Result Areas

The CyRAACS Professional Mindset

• Beyond qualifications and experience, a CyRAACS professional demonstrates:
• Speed in execution: delivering with urgency without sacrificing quality
• Ownership of outcomes: treating client success as a personal commitment
• Comfort with ambiguity: navigating complex, evolving cybersecurity environments with composure
• Continuous learning: staying ahead in a domain where yesterday’s knowledge is not enough
• Collaborative drive: contributing to team performance, not just individual output

Required Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a relevant field.
• 5–6 years of relevant experience in GRC, information security compliance, or regulatory advisory, with substantial hands-on delivery across multiple frameworks.
• Experience turning regulations or standards into material that others use — controls, testing procedures, audit programmes, policies, or assessment questionnaires. What matters is that you have created this material yourself, not only worked from material prepared by someone else.
• Audit and assessment experience is valued, provided it reflects an understanding of why a control exists and what would cause it to fail. Experience limited to working through prepared checklists, or to coordinating certification programmes, will not be sufficient on its own.
• Certifications (where applicable): ISO 27001 Lead Auditor or Lead Implementer, CISA, CRISC, CISM.

Required Skills and Competencies

Technical Skills

• Working command of Indian BFSI regulatory frameworks — RBI, SEBI, IRDAI, DPDP — and of global standards including ISO 27001, ISO 27002, SOC 2, and PCI DSS, with the ability to read a regulation and determine what it actually obliges an entity to do.
• Demonstrated ability to decompose a regulatory obligation into discrete, independently testable controls, and to specify the evidence each requires.
• The ability to look at a requirement in one standard and a requirement in another, and judge whether they are asking for the same thing or for two different things.
• Practical fluency with large language models — writing structured instructions, testing outputs against defined criteria, and diagnosing why a generated result is wrong. Prior experience building AI skills or agents is an advantage; the willingness and aptitude to learn is mandatory.
• The ability to write down how a compliance evaluation is made — what to look for, what counts as acceptable, and how you would know the answer was wrong — clearly enough that someone else can follow it and reach the same conclusion.

Behavioural Competencies

• Strong communication and stakeholder management skills
• Problem-solving and analytical thinking under pressure
• Ownership, accountability, and bias for action
• Team collaboration and cross-functional effectiveness
• Adaptability and learning agility in a fast-evolving domain

Preferred Qualifications

• 3–4 years of experience in cybersecurity consulting, or within BFSI, fintech, or another regulated industry context.
• Exposure to GRC platforms, third-party risk management frameworks, or AI-driven compliance
• technologies.
• Understanding of how software products are built, prioritised, and shipped.
• Ability to test software functionally against a specification and articulate defects precisely.
• Experience across more than one of: continuous compliance, third-party risk management, policy management, risk management, or audit workflow.

What CyRAACS Offers You

• Exposure to marquee client engagements across India’s most regulated industries
• Access to COMPASS, an AI-first GRC platform at the frontier of cybersecurity technology
• Structured learning, certification sponsorship, and a clear career progression framework
• A high-performance culture anchored on ownership, speed, and continuous improvement