Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted yesterday

Information Security- GRC

Fortive109 open roles

Where
India, Remote, India
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowInformation Security- GRCFortive · India, Remote, India

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on Fortive's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

13.3% of postings close within 7 days. Measured by our own scanner across the market. Fortive postings stay open a median of 13 days.

Share of postings closed within
  1. 2.1%1 day
  2. 4.6%3 days
  3. 13.3%7 days
  4. 21.3%14 days
  5. 35.7%30 days
  6. 59.1%60 days
This job: posted yesterday

Fortive median: 13 days open

The posting

Job Description

Information Security Compliance Analyst

Job Description:

Fluke's Information Security GRC team is seeking an experienced compliance professional to lead day-to-day execution of our audit and certification programs which include: SOX ITGC / ITAC, ISO 27001, SOC 2 Type II, NIS2, EU Cyber Resilience Act, and Cyber Essentials Plus. Also to help extend our coverage into emerging regulatory and AI governance requirements. You will serve as a primary point of contact for our external auditors and Internal Audit, translate audit requirements into clear asks for IT and business control owners, and keep evidence accurate, complete and on time.

This is more than an audit compliance role. You will also own key parts of our risk program, third-party risk management (TPRM) and enterprise / information security risk management (ERM) and help customers trust Fluke products by completing security questionnaires and assessments about our products, software and services.

Reporting to the Senior Information Security Compliance Lead, you will step into ownership of established workstreams through a structured onboarding and knowledge-transfer period, and are expected to operate independently on core audit programs within the first six months. This role is critical to protecting Fluke's audit posture, reducing compliance risk, and keeping our commitments to auditors, Fortive and customers.

Responsibilities:

Audit leadership & SOX

  • Lead SOX ITGC and ITAC execution: quarterly and occurrence-based control performance, roll-forward inquiries, control testing and evidence submission, in partnership with the external auditor and Fortive Internal Audit.
  • Act as primary audit liaison: lead walkthroughs, manage PBC / evidence requests, translate auditor follow-ups into defined requirements for control owners, and deliver complete evidence before deadlines.
  • Coordinate evidence across key systems, including ERP, data and analytics platforms, and change-management tooling. Covering privileged access, change management, key reports / IPE and ITAC configurations.
  • Maintain segregation of duties within the team's test / review / sign-off model, performing control testing and secondary review as required.
  • Track and report control status, remediation items and prior-year improvement opportunities to GRC leadership and Finance stakeholders; act as SOX lead during the Compliance Lead's absence.

Certifications & attestations

  • Own ISO 27001 control operations: control ownership, quarterly access reviews, control evaluations, corrective actions, and surveillance / recertification audits, including onboarding new products into scope.
  • Lead or support SOC 2 Type II and Cyber Essentials / CE+ audits from scoping and kickoff through auditor facilitation and evidence collection.

Customer & product security assurance

  • Own completion of customer security questionnaires and RFP / RFI security sections for Fluke products, software and services (including connected test tools, coordinating with Product Security, Engineering, IT, Legal and Sales for accurate, on-time responses.
  • Maintain an approved answer library and supporting evidence (policies, certifications, SOC 2 reports, penetration test summaries) and keep Trust Center content current.
  • Support customer and supplier security audits and assessments, and track security commitments made to customers through to closure.
  • Escalate product-specific gaps or contractual security requirements to Product Security and Legal, and feed recurring customer asks back into the control program.

Regulatory frameworks & emerging requirements

  • Maintain framework mappings (SOX, ISO 27001, SOC 2, NIST 800-171 / CMMC, NIS2, PCI DSS, EU Data Act) to a unified control set so controls are tested once and satisfy many requirements.
  • Support EU Cyber Resilience Act (CRA) compliance with Product Security / PSIRT, and monitor and gap-assess new cybersecurity regulations with Fluke Compliance teams to reduce duplicate work.

Third-party risk management (TPRM)

  • Own the TPRM process from intake to closure, managing a steady volume of vendor requests: scoping, risk tiering, and determining when suppliers fall outside TPRM scope.
  • Conduct vendor security assessments, review security questionnaires, SOC reports, certifications and contract security terms, and document risk-based approvals, conditions (e.g., use of Fluke-provided environments) and remediation.
  • Partner with Procurement, Legal and business owners so reviews keep pace with onboarding; establish ongoing monitoring for critical suppliers and AI-specific vendor review criteria.

Enterprise risk management (ERM)

  • Maintain the information security risk register and risk-acceptance process: risk assessments, owner accountability, expiring acceptances and migration of legacy risk records.
  • Drive corrective actions and overdue control evaluations to closure, following up with control owners and escalating only when blocked.
  • Support enterprise risk reviews and the Risk Profile, including IAM / MFA metrics and remediation campaigns, and prepare risk reporting for InfoSec leadership.

GRC tooling & program operations

  • Administer and improve tools as the system of record for GRC controls, help design controls by framework, dashboards, control-gap reports, evidence views and auditor-facing access.
  • Drive evidence automation and continuous control monitoring to shorten audit cycles and catch control failures between audits.
  • Author and maintain SOPs, guidelines and policies, converting recurring work into documented standard work.

Qualifications:

Required

  • 5+ years in IT compliance, IT audit or GRC related roles
  • Demonstrated experience as the primary liaison with external auditors, leading walkthroughs, managing evidence requests and remediating findings within audit timelines.
  • Working knowledge of ISO 27001 ISMS operation and certification audits, and experience supporting SOC 2 Type II.
  • Familiarity with additional frameworks such as NIST 800-171 / CMMC, Cyber Essentials, EU CRA and NIS2.
  • Hands-on third-party and enterprise risk management experience: vendor security assessments, SOC report review, risk tiering, risk registers and risk-acceptance workflows.
  • Experience completing customer security questionnaires (e.g., SIG, CAIQ or custom customer assessments) and RFP security responses, ideally for hardware, software or SaaS products.
  • Hands-on experience with a GRC platform.
  • Proven ability to lead multiple concurrent audits and workstreams independently and meet fixed deadlines.
  • Effective written and verbal communication, with the ability to explain complex compliance requirements to technical and non-technical stakeholders.
  • Demonstrated ability to work collaboratively and build positive working relationships with colleagues at all levels, including global teams.
  • High level of integrity and ethics, maintaining confidentiality and professionalism in handling sensitive information.

Preferred

  • Professional certification: CISA, CRISC, CISSP, CISM, or ISO 27001 Lead Auditor / Lead Implementer.
  • Experience with emerging requirements such as the EU Cyber Resilience Act, product security compliance, or AI governance frameworks (EU AI Act, NIST AI RMF, ISO/IEC 42001).
  • Familiarity with product security standards and practices (e.g., IEC 62443, secure development lifecycle, SBOM, coordinated vulnerability disclosure) to answer product-related customer inquiries.
  • Experience harmonizing controls across frameworks (e.g., Secure Controls Framework) and automating evidence collection.
  • Experience in a manufacturing, industrial technology or multinational, matrixed environment.
From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against Fortive's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on Fortive's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    Fortive's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.