Security Compliance Manager

Role Purpose:

Own the end-to-end implementation, hardening, and governance of Microsoft 365 E5 across Pay10 India, aligning to RBI requirements and relevant local regulations. Establish Zero-Trust controls, identity governance (PIM/PAM), information protection, and audit-ready compliance operations.

Key Responsibilities

Architecture & Rollout

• Design the M365 E5 security architecture (Identity, Access, Devices, Data, Threat, Governance).
• Implement

  Entra ID P2

  ,

  PIM/PAM

  ,

  Conditional Access

  ,

  MFA

  ,

  SSPR

  ,

  Break-glass

  strategy.
• Deploy

  Defender for Office 365, Defender for Endpoint, Defender for Cloud Apps (CASB/MCAS)

  .
• Implement

  Purview

  : Information Protection (MIP sensitivity labels),

  DLP

  ,

  Records/Retention

  .
• Intune device compliance, baselines, and app protection policies (Windows, macOS, iOS/Android).

Compliance & Audit

• Map M365 controls to

  RBI IT Framework

  , DPDP Act 2023, ISO 27001, PCI-DSS
• Configure

  Compliance Manager

  scorecards, assessments, evidence, and audit artifacts.
• Define

  data classification

  , legal holds, retention schedules, and cross-border data handling.

Operations & Governance

• Build SOPs/runbooks: joiner-mover-leaver, incident response, PIM approvals, break-glass drills.
• Establish

  monitoring & reporting

  (KQL, Power BI, Graph API) for compliance and security posture.
• Conduct KT to internal admins; lead CAB/ISMS change processes; drive continuous improvement.

Stakeholder & Vendor Management

• Collaborate with customer’s finalized vendor(s) for network security alignment and integrations.
• Manage regional rollouts; coordinate with legal/compliance for evidence packs and audits.

Required Experience

• 4-5+ years hands-on with

  M365 E5

  security & compliance at enterprise scale.
• Deep expertise in

  Entra ID P2 (PIM/PAM)

  , Conditional Access, Defender suite, Purview (MIP/DLP/eDiscovery), Intune.
• Proven delivery in

  regulated financial services

  (banks/NBFC/fintech/payments).
• Strong understanding of

  RBI

  ,

  DPDP 2023

  ,

  ISO 27001

  ,

  PCI-DSS

Success KPIs

• E5 controls implemented & validated (India) within agreed timeline.
• Compliance score uplift (Compliance Manager) and successful internal audit sign-off.
• MTTR for security incidents reduced; zero critical audit non-conformities.
• Successful replication to the first GCC region with documented SOPs and KT.