Hire Security Compliance Intern — the employer’s brief

None professionally, and that is the point. What you should expect is evidence: something built, run or fixed involving GRC tooling or spreadsheets or Policy templates, that they can talk about in depth. Screen on persuading another team to fix something that is not their priority and chasing evidence from busy people without escalating every time; treat everything else on the list as trainable during the term.

One finished thing. Turn one scan output into a ranked, owned action list with agreed dates is the right size: real work someone on the team would otherwise do, small enough to finish, visible enough to assess. If they move quickly, build the evidence pack for one control area before the audit asks for it is the natural second piece. A term with three half-finished projects assesses nothing and teaches less.

₹14,000 to ₹34,000 a month covers most of the market for this role. Metro product companies pay at the top of the band; tier-2 cities and services firms 25–40% lower. An unpaid listing filters for who can afford to work free rather than who is good, and roughly halves the applications you receive.

For a first pass, yes. Ask "What makes an audit finding legitimate rather than pedantic?" and judge whether the answer is specific and consistent — you are checking for judgement about control intent, which does not require you to know the subject. A GRC practitioner should still take the second round, because at that point you are assessing depth rather than authenticity.

One finished, reviewed piece of work that someone on the team would otherwise have done — not a side project nobody adopts. The deliverables above are sized for eight to twelve weeks of supervised work by a student with the fundamentals but no production experience. If they can demo it and the team keeps using it after they leave, the hire paid for itself.

The "Security" qualifier changes who the work is for: findings have to be actioned by other teams. Screen for the ability to get a fix made, not just to produce a finding. In screening terms, that means adding one specific check: persuading another team to fix something that is not their priority.

A compliance brief is evidence collection and follow-up. It rewards persistence over cleverness, so screen for how they chase people who are ignoring them. In screening terms, that means adding one specific check: chasing evidence from busy people without escalating every time.

First applications typically arrive within about two hours of the listing going live, and most employers hiring a GRC intern have a workable shortlist inside a week. Speed depends more on how specific the brief is than on the stipend — a listing with a named project and named tools consistently outperforms a generic one at the same money.

Both. The pool covers every major hiring city and hundreds of tier-2 and tier-3 towns, and the role can be posted as remote, hybrid or on-site. For GRC work specifically, remote widens the pool considerably — filter on skill and availability rather than pin code unless the work genuinely requires presence.