Position:

IT Security Associate - Governance, Compliance and Risk

Job Description:

About the Role

Arrow Electronics is looking for a Governance, Risk and Compliance apprentice to join our IT Risk and Governance team in India. This role is built specifically for a student who has completed a university degree and who wants to learn how information security governance actually works inside a global technology distributor, rather than only in a textbook. You will sit with the team that owns Arrow's security certifications, risk framework and compliance programs, and you will contribute to live work from your first month.

We do not expect you to arrive knowing our frameworks. We expect curiosity, care with detail, and the willingness to ask questions in a room full of experienced practitioners. Everything else is taught, and your schedule is designed around your coursework and examinations.

About the Team

IT Risk and Governance is part of Arrow's Enterprise Security Services organization. The team maintains the Information Security Risk Management Framework, owns the security policy and standards library, runs third-party and vendor risk assessments, and delivers the certification programs that Arrow's customers and contracts depend on. Our current portfolio includes the global ISO 27001 certification program spanning the Americas, EMEA and APAC, CMMC Level 2 readiness for our aerospace and defense business, TISAX assessments for automotive customers, and the consolidation of our GRC tooling onto a single platform.

The team is deliberately small and global. Members include information security architects, IT compliance analysts, a data security analyst and project managers, working across US, EMEA and APAC time zones. The apprentice reports to the Director, IT Risk and Governance and works day to day alongside a compliance analyst and a security architect.

What You Will Work On

The work is real and it changes with the program calendar. Over the course of the apprenticeship you can expect to contribute to several of the following.

• Evidence collection and tracking for the global ISO 27001 certification program, including chasing outstanding artefacts from control owners and keeping the evidence register current.
• Support for CMMC Level 2 readiness activities, such as maintaining control status trackers and helping assemble documentation packages ahead of assessment milestones.
• Third-party and vendor risk assessments: reviewing questionnaire responses against our Vendor Risk Assessment Standard and flagging gaps for an analyst to validate.
• Migration and data quality work as we consolidate our GRC tooling onto a unified platform, including mapping controls between frameworks and cleaning up legacy records.
• Maintenance of the security policy and standards governance library, including formatting, version control and tracking annual review dates.
• Preparation of recurring reporting, including program status summaries and metrics that go to security leadership.

Key Responsibilities

• Keep assigned trackers, registers and evidence repositories accurate and current, and raise items that are slipping before they become escalations.
• Draft clear, concise summaries of findings and status for review by an analyst, architect or the director.
• Follow up with control owners and other stakeholders across Arrow to request evidence, clarify responses and confirm closure of open items.
• Compare documentation and questionnaire responses against published Arrow standards and applicable control frameworks, and record where they do not line up.
• Handle confidential and restricted information with the discretion the classification requires, and complete all assigned security training on time.
• Attend program stand-ups and take accurate notes, actions and owners.
• Ask when something is unclear rather than guessing, and tell your mentor early when coursework will affect your availability.

What You Will Learn

This apprenticeship is structured as a learning path, not an administrative placement. By the end of twelve months a successful apprentice should be able to do the following.

• Explain how an ISO 27001 certification cycle runs end to end, from scoping and evidence to external audit and corrective action.
• Read a control framework such as ISO 27001 Annex A or NIST SP 800-171 and trace a requirement to the evidence that satisfies it.
• Run the first pass of a vendor risk assessment against a published standard.
• Work confidently inside a GRC platform, including control mapping, task assignment and reporting.
• Write for a security leadership audience: short, factual, and clear about what changed and what needs a decision.

Who We Are Looking For

Required

• Currently enrolled in a bachelor's or master's program at a recognized university in India, with at least one academic year remaining at the start of the apprenticeship.
• Studying a relevant field such as information technology, computer science, cyber security, information systems, engineering, commerce, law or business administration. We hire for aptitude, not for a single degree.
• Strong written and spoken English, since most of the team and its stakeholders are outside India.
• Comfortable with Microsoft Excel, Word, PowerPoint and Teams, and willing to learn new tools quickly.
• Genuinely careful with detail. Much of this work is the difference between an assessment that passes and one that does not.
• Available for the agreed weekly hours and able to overlap with colleagues in EMEA and the United States for part of the week.

Preferred

• Coursework, certification study or project work touching information security, audit, risk management or data privacy.
• Familiarity with any control framework or standard, including ISO 27001, NIST, SOC 2, PCI DSS or GDPR, at an introductory level.
• Exposure to a GRC, ticketing or project tracking platform, or to basic data handling in Excel or Power BI.
• Student leadership, campus club, hackathon or volunteer experience that shows follow-through.
• An interest in continuing in security governance after graduation. Strong apprentices are our first consideration for entry-level openings on the team.

What’s in for you

• On the job skill-based training, projects, assignments, opportunity to learn new skills.
• Annual Fixed Stipend (INR 30,000 per month)
• Insurance (Self):
  • Medical : Coverage of INR 500,000/-
  • Accidental & Life as per policy
• Time off:
• 20 days of Annual leave
• 12 days of Casual/Sick leave &
• 10 days of Holidays (Festival & National)

 

About Arrow

Arrow Electronics, Inc. (NYSE: ARW), an award-winning Fortune 148 and one of Fortune Magazine’s Most Admired Companies. Arrow guides innovation forward for over 220,000 leading technology manufacturers and service providers. With 2025 sales of USD $30.9 billion, Arrow develops technology solutions that improve business and daily life. Our broad portfolio that spans the entire technology landscape helps customers create, make and manage forward-thinking products that make the benefits of technology accessible to as many people as possible. Learn more at www.arrow.com.

Our strategic direction of guiding innovation forward is expressed as Five Years Out, a way of thinking about the tangible future to bridge the gap between what's possible and the practical technologies to make it happen. Learn more at https://www.fiveyearsout.com/. 

Location:

IN-KA-Bangalore, India (SKAV Seethalakshmi) GESC

Time Type:

Full time

Job Category:

Business Support