Senior compliance engineer at Hevo Data Bengaluru, owning the GRC program end to end - SOC 2, GDPR, HIPAA, DORA and DPDP - as enterprise security reviews become central to how deals close.

This full-time Bengaluru role was posted on 14 October 2026. Hevo is a no-code data pipeline platform with 150+ connectors, trusted by more than 2,000 organisations, and compliance is how it earns that trust. The listing makes the commercial context explicit: as the enterprise customer base grows, security and compliance reviews are an increasingly visible part of how deals get done. The role owns the compliance program end to end, from control implementation through evidence collection and audits.

About Hevo Data

Hevo Data is an Indian SaaS company whose no-code data pipeline platform moves, transforms and activates data in real time. Per its listings, it offers 150+ pre-built connectors and is used by more than 2,000 organisations, with compliance coverage including SOC 2, GDPR, CCPA, DORA and HIPAA.

Hevo is based in Bengaluru and hires across engineering, platform, security and compliance roles, per its listings. Learn more on Hevo Data's website.

The role in plain terms

This is compliance tied directly to revenue: the listing says security and compliance reviews are an increasingly visible part of how deals get done as the enterprise customer base grows, which means working with sales and solutions teams on customer security reviews, not just with auditors. Owning multiple frameworks at once - SOC 2, GDPR, HIPAA, DORA and DPDP as applicable - rewards someone who maps controls across standards rather than running each audit as a separate project.

The team and the work

Hevo's platform moves customer data continuously, so its compliance posture is a product feature as much as a legal requirement. The DPDP mention is notable: India's data protection law is newer, and the listing treats it alongside GDPR and HIPAA, which signals the customer mix spans India and global enterprises. The 4+ years requirement in GRC, audit or information security fits someone who has already run at least one full audit cycle.

What the employer asks for

These requirements are quoted from the employer's listing, kept in their exact words so eligibility details are not distorted:

4+ years in GRC/compliance engineering or related roles (compliance, audit, information security)
Hands-on experience running SOC 2/ISO 27001 (or similar) audits end-to-end
Strong understanding of data protection & privacy — GDPR, HIPAA, PII/PHI handling
Proven ability to manage vendor/third-party risk assessments
Excellent written and verbal communication — comfortable presenting to and negotiating with external customers, auditors, and executives
Experience responding to customer security questionnaires / RFPs
Working knowledge of cloud environments (AWS) — enough to assess and discuss controls with engineering
Strong organizational skills — able to manage multiple audits and timelines independently

Who this role suits

GRC or compliance engineers with 4+ years who want ownership of a whole program at a growing SaaS company. Strong fit for people who like the customer-facing side of compliance - security questionnaires, enterprise reviews, audit evidence - not only internal controls. Not for candidates seeking a large established compliance department with narrow scope.

Practical notes

Expect questions on how you keep evidence collection continuous rather than scrambling before audits, and how you prioritise overlapping framework requirements. Familiarity with compliance automation tooling is worth surfacing.

Working at Hevo Data

Engineering at Hevo centres on data pipeline infrastructure: connectors, streaming systems, and the AWS/GCP and Kubernetes platform underneath, per its listings.

How to apply

Apply directly on the employer's site: Senior Compliance Engineer at Hevo Data. We found this listing on the Lever public postings feed (jobs.lever.co), where it was posted on 14 Oct 2026 and was still open when we checked on 30 Oct 2026. Before applying, re-read the employer's own description in full, since eligibility details, deadlines and process steps can change at any time and the employer's page is always the final word. Tailor your resume to the specific requirements above rather than sending a generic one: mirror the skills and tools the listing names where you genuinely have them. A short, specific note on why this team and this problem interest you goes further than a long generic cover letter. Never pay a fee to apply or interview; genuine employers, including this one, do not charge candidates.

Related openings on GetFirstJob

If this role is not the right fit, these current openings are in a similar area:

We write and maintain this page from the employer's public listing and link straight to their application page. We do not act as a recruiter, and applying is always free. If the link above stops working, the role has likely been filled.

This is our short summary of the employer's listing. The full description, eligibility and deadline are on the employer's page.