Sprinto Hiring InfoSec Compliance Intern | Remote India

Sprinto is hiring an Information Security Compliance Intern for its GRC and Infosec team, working remotely from India. The role sits in the Audit Experience function and teaches you how SOC 2 and ISO 27001 audits work, with day-to-day support tasks on audit partners, directories and evidence mapping.

Job Overview

About the company

Sprinto describes itself as an autonomous trust platform that helps organisations stay audit-ready across security frameworks, vendors and customers. According to the posting, it was founded in 2020, has raised 31.8 million dollars, and supports over 200 global security standards including SOC 2, ISO 27001, GDPR, HIPAA and PCI-DSS. Those are the company's own statements on its job page, so read them as such.

What the role is about

The posting says the Audit Experience function manages Sprinto's relationship with its audit partner ecosystem. The internship is described as a structured way to build real subject-matter expertise in GRC and audit by working alongside an SME on live programmes, rather than learning theory alone. You will see how audit programmes run, how compliance controls are judged, and how information and cybersecurity requirements turn into audit expectations.

🔔 Get jobs like this daily on WhatsAppJoinTelegram

Key Responsibilities

• Audit partner enablement operations: track audit partners through onboarding and enablement, maintain internal trackers, coordinate across teams to clear blockers and flag partners who stall.
• Auditor directory maintenance: keep the auditor directory accurate, verify accreditation status against the relevant accreditation bodies and update partner profiles.
• Evidence mapping support: help the SME map audit evidence requirements to platform capabilities, prepare reference data, find gaps and document findings.
• Audit partner vetting: run the verification process for new audit partner candidates.
• Query management: act as first responder for routine auditor and internal queries, and escalate non-routine matters to the SME.
• AI-assisted workflow building: build and improve AI agents for routine tasks such as auditor queries, periodic directory reviews and evidence mapping lookups, using tools like Claude, ChatGPT or Gemini to design prompts and test agentic workflows.
• Ad hoc support: help the SME with research, documentation, process improvement and cross-functional coordination.

Eligibility Criteria

The posting asks for a completed graduation or master's degree in GRC, Information Security, Risk Management, Computer Science or a related field, and says candidates with a GRC or audit academic background are strongly preferred. Prior exposure to audits through academic projects, internships or jobs is a strong plus.

Skills Required

• Real curiosity about information and cybersecurity, and how audit frameworks connect to actual security posture
• Comfort with spreadsheets, trackers and data
• Strong attention to detail, because verification and mapping reviews are precision work
• Good written communication for documenting processes and replying to audit partner queries
• Comfort with GenAI tools such as Claude, ChatGPT or Gemini. Building agents or automating workflows with AI is a strong plus, but the posting says a genuine appetite to learn matters most.
• Self-direction: the SME gives guidance and review, but you are expected to own the operating rhythm independently.

Salary & Benefits

The posting does not state a stipend, internship length or any perks. Ask for these in writing before you accept. If the duration and conversion terms are unclear, treat that as a question to settle early, not an assumption.

Is this job right for you?

This is a good match if you are a graduate who wants a way into cybersecurity governance without starting as a hands-on penetration tester. GRC is a large field: audit, risk, privacy and compliance work all need people who can read a framework and check whether evidence matches it. If you like checklists, structured thinking and clear writing, you may enjoy it.

It may not suit you if you want to write code or find vulnerabilities all day. The core work is tracking, verifying, mapping and answering queries. It also asks you to be self-directed in a fully remote team, with limited hand-holding.

Honest flags: the posting does not say whether the internship is paid, how long it runs, or whether it can turn into a full-time role. It also states that AI tools may be used to review applications, which is useful to know: write your resume clearly and keep every claim accurate.

A realistic day in the role

Based on the listed duties, a day might start with checking an onboarding tracker and nudging two audit partners who have not sent documents. Then you verify an auditor's accreditation on a public accreditation body page and update their profile. After lunch you answer a routine query from an audit partner using a standard response, and escalate one odd question to the SME. Later you test a prompt that an AI agent uses to answer common directory questions and note where it fails. This is general guidance drawn from the duties, not an official schedule.

How to prepare in 7 days

1. Day 1: Read a plain-language overview of SOC 2: the trust services criteria and the difference between Type 1 and Type 2.
2. Day 2: Read an overview of ISO 27001: the ISMS idea, risk assessment and Annex A controls.
3. Day 3: Learn the vocabulary: control, evidence, audit scope, auditor, finding, remediation.
4. Day 4: Practise spreadsheets: build a tracker with status columns, filters and simple formulas.
5. Day 5: Write three short, polite emails: a reminder, a clarification and an escalation.
6. Day 6: Try prompting a GenAI tool to summarise a policy and check where it gets facts wrong.
7. Day 7: Prepare a short answer on why you want GRC, and one example of attention to detail in your past work.

Sample questions with answer hints

General practice questions only, not confirmed for this company.

• What is the difference between SOC 2 Type 1 and Type 2? Type 1 looks at control design at a point in time. Type 2 tests operating effectiveness over a period.
• What counts as audit evidence? Screenshots, logs, policies, tickets and reports that show a control is in place and working.
• How would you check data accuracy in a directory? Compare against the primary source, record the date checked and flag differences.
• How would you use AI safely for repeat tasks? Give clear instructions, test on known cases, verify outputs and keep a human review step.

Career path

GRC interns often grow into compliance analysts, audit coordinators, security risk analysts or customer-facing compliance roles. Certifications such as ISO 27001 Lead Implementer or CISA come later, with experience. Compare with another security-flavoured fresher opening, the Episode Six SOC Graduate Trainee role, and see our Secfix remote engineering opening to see how security-focused companies hire.

Application checklist

• Highlight any course, project or internship involving security, risk, audit or compliance.
• Add comfort with spreadsheets and GenAI tools to your skills.
• Keep a short writing sample ready, such as a policy summary.
• Use our resume tips for freshers to keep the resume to one page.
• Keep your documents handy: documents required for job applications.

How to Apply

Apply through the official Sprinto jobs page linked on this post. Because the role is remote, scammers often target such listings, so check that the link starts with the official job board and that nobody asks for money. See how to identify fake job offers.

Related Reading

For more openings, browse internships and IT jobs.