Why Choose Bottomline?

Are you ready to transform the way businesses pay and get paid? Bottomline is a global leader in business payments and cash management, with over 35 years of experience and moving more than $16 trillion in payments annually. We're looking for passionate individuals to join our team and help drive impactful results for our customers. If you're dedicated to delighting customers and promoting growth and innovation - we want you on our team!

Why Choose Bottomline?

Are you ready to transform the way businesses pay and get paid? Bottomline is a global leader in business payments and cash management, with over 30 years of experience and moving more than $10 trillion in payments annually. We're looking for passionate individuals to join our team and help drive impactful results for our customers. If you're dedicated to delighting customers and promoting growth and innovation - we want you on our team!

The Role

We are looking for a dynamic and innovative Information Security GRC Analyst to join our team in Bangalore.

Job Summary  

This role reports to the Information Security Governance, Risk and Compliance (GRC) Manager and will work across all the product and technology teams to strengthen and enforce Bottomline’s information security posture. 

As the Information Security GRC consultant, you will be responsible for building trust and confidence among our clients on the information security posture.  This role also involves working closely with stakeholders to ensure adherence to regulatory requirements and security frameworks (e.g., SWIFT, NACHA, PCI, NIST, GLBA). 

How you’ll contribute

Governance – work with key stakeholders to develop, implement and enhance the information security policies, standards and processes in alignment with regulatory requirements and security frameworks (e.g., SWIFT, NACHA, PCI, NIST, GLBA). Execute governance routines and reporting to ensure compliance with required policies and standards.

Risk Management – build and maintain a control library for enterprise-wide controls and product specific controls. Maintain the risk register (issues and risk acceptances) to ensure effective tracking, prioritization and reporting of risks.   Process risk acceptances to ensure they are appropriately rated with sufficient mitigating controls.

Compliance – Coordinate assessments to ensure compliance with applicable regulations and industry requirements (e.g., SWIFT, NACHA, PCI, NIST, GLBA).

Client Support - Gather, assess and present the information security posture to customer (i.e., completion of request for information, contract language reviews, completion of due diligence questionnaires etc.).

Education and Awareness – develop and deliver information security awareness and training

If you have the attributes, skills, and experience listed below, we want to hear from you.

Bachelor’s degree in risk management, cybersecurity, technology or equivalent

 Preferred Experience & Qualifications

Cyber or risk management certifications

Understanding and knowledge of cyber regulatory and industry frameworks (i.e., SWIFT, NACHA, PCI, NIST, GLBA)

We welcome talent at all career stages and are dedicated to understanding and supporting additional needs. We're proud to be an equal opportunity employer, committed to creating an inclusive and open environment for everyone.

Bottomline – RoW Candidate Privacy Notice

What is the purpose of this document?

This is a Candidate Privacy Notice for (each “Bottomline” “we” and “us”). The Controller in relation to personal data will be the Bottomline company to which you have applied. The Controller is responsible for deciding how it holds and uses your personal data. You are being sent a copy of this Privacy Notice because you are applying for work with Bottomline (whether as an employee, worker or contractor). It makes you aware of how and why your personal data will be used, namely for the purposes of the recruitment exercise, and how long it will usually be retained for.

Principles of data protection

Personal information (also referred to as personal data) means information (or a combination of information) relating to a person which allows that person to be identified. This does not include information where it is not possible to identify a person.

The principles of data protection are outlined below, we will comply with all applicable laws, and ensure that your personal information is:

Processed lawfully, fairly and in a transparent
Processed for limited purposes, clearly explained to you in this notice or
Relevant to only the purposes that we have told you
Accurate and kept up to
Kept only for as long as
Kept

The data we collect:

In connection with your application to work with us, we will collect, store, and use the following categories of your personal information:

Information you have provided in your resume/curriculum vitae and covering letter.
Information you have provided on our application form, including name, title, telephone number, personal email address, gender, salary information, notice period, information on your right to work in the applicable country, and any other information we may deem essential to assess your suitability for the position.
Any information you provide during an interview.
Test Results (e.g. technical assessments or equivalent), passport copies (and marriage certificate if required for change of name), proof of address. Should you contact us regarding your application or related activities such as interviews we may hold this correspondence for future reference. This includes the status of your application.

Where necessary, we may also collect, store and use the following types of more sensitive personal information:

Information about your race, ethnicity, or gender.
Information about any reasonable adjustments you require in the workplace for your health.
Information about criminal convictions and offences.
Information from global sanctions and Politically Exposed Persons checks.

We will only collect information about criminal convictions where it is necessary, lawful, and relevant to the nature of the role. This would be carried out by our background checking partner, and they may share it with us, if we would like to offer you the role (conditional on checks and any other conditions, such as references, being satisfactory).

How do we collect your personal information?

We usually collect personal data from candidates using an application tracking system. We may also automatically collect certain information, such as IP addresses and device identifiers. Should it not be collected during your initial application process, we may use the following sources to collect your personal information:

You, the candidate.
Our Talent Operations team may request the following information for the purpose of onboarding; CV, name, preferred name, date of birth, gender, marital status, ID number, proof of ID, photo, address, proof of address, telephone number, email address, emergency contact details, workplace adjustments required, work experience and education details, current salary, notice period and reason for leaving, banking, tax and benefits information, as required for the location of the role for which you are being considered.
Any recruitment agency through which you apply or are recommended by, from which we collect the following categories of data: including name, title, address, telephone number, personal email address, date of birth, gender, employment history, qualifications, remuneration, benefits information, proof of identity, proof of address and any other information deemed relevant to the role for which you are being considered.
Our background check provider, from which we collect the following categories of data: identity and right to work confirmation, criminal history, global sanctions and politically exposed persons (PEP) screening, education and employment verification, credit and financial background (where relevant), directorships and conflict of interest checks, and adverse media searches. All checks are conducted only where necessary and appropriate for the position, in accordance with applicable laws and with your explicit consent.
Your named referees, from whom we collect the following categories of data: job title, dates of employment, reason for leaving, rehire information.

How is your personal information used?

We will use the personal information we collect about you to:

assess your skills, qualifications, and suitability for the role;
carry out background and reference checks, where applicable;
communicate with you about the recruitment process;
keep records related to our hiring processes; and
comply with customer, legal or regulatory requirements.

It is in our legitimate interests to decide whether to appoint you to a role since it would be beneficial to our business to appoint someone to that role.

We also need to process your personal information to decide whether to employ you.

Having received your resume/curriculum vitae and application, we will then process that information to decide whether you meet the basic requirements to be shortlisted for the role. If you do, we will decide whether your application is strong enough to invite you for an interview. If we decide to call you for an interview, we will use the information you provide to us at the interview to decide whether to offer you the role. If we decide to offer you the role, we will then take up references, carry out criminal record and background checks and/or carry out any other checks that are deemed as necessary to consider your suitability for the role before confirming your appointment.

We may also anonymise your personal information so we can use it for statistical and analytical purposes.

Change of purpose

We will use your personal information only for the purposes it was collected, unless we reasonably believe that we need to use it for another reason, and that reason is compatible with the original purpose. If we need to use your personal information for a different purpose, then we will notify you and explain the legal basis for this.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

What if you do not want to provide personal information?

If you do not want to provide personal information to us, which is necessary for us to consider your application (such as evidence of qualifications or work history), we will not be able to process your application successfully. For example, if we require a credit check or references for this role and you fail to provide us with relevant details, we will not be able to take your application further.

How is your sensitive personal information used?

In general, we will not process particularly sensitive personal information about you unless it is necessary for performing or exercising obligations or rights in connection with application. On rare occasions, there may be other reasons for processing, such as it is in the public interest to do so. Examples of how we will process particularly sensitive personal information are as follows:

Where relevant, we will use information provided about any adjustments required in the workplace where it may require us to provide appropriate adjustments during the recruitment process, for example whether adjustments need to be made during an interview.
We may use information about your race or national or ethnic origin, to ensure meaningful equal opportunity monitoring and reporting, particularly where required by law or government, but it will not be used to determine whether or not you are given the role.
We will use information provided in your background checks to determine your eligibility for the position.

Where appropriate, we will use the information about criminal convictions and offences to ensure you are suitable for roles that require a high degree of trust and integrity and to meet our contractual and regulatory requirements. All such processing will be conducted in accordance with relevant data protection and employment laws in the jurisdictions where we operate.

Sharing your personal information

We will share your personal information with third parties, including third-party service providers and other entities in the group, where required by law, where it is necessary to administer the application process or where we have another legitimate interest in doing so.

We may share your personal information with our affiliates (including our US parent company ), if the hiring manager (or other key personnel) are based there or where they perform a key function, such as application processing, data analysis or preparing a contract, for the Bottomline group and need the personal information, as part of that function.

We also share your personal information with applicable third parties in the ordinary course of business, such as professional advisors, third-party service providers and government or similar organizations.

If we share your personal information with any third parties, we will ensure that it is processed in an appropriate manner and take all necessary measures to protect it. We will follow all applicable laws when transferring your personal information outside of your country.

As part of your application to us, we currently share your personal information with the below third parties for the purposes specified. For details on how we do this please contact the DPO or HR.

Third Parties	What they do?
Greenhouse Software Inc	Managing the Candidate Hiring Process
Sterling Infosystems, Inc
Microsoft Corporation	Recording of Teams meetings, production and summarising of transcripts as well as storage and processing of data within Office applications
Talend, Inc	Data quality, integration and anonymisation

Security of candidate personal information

We have in place the appropriate security measures to prevent your personal information being accidentally lost, used, accessed in an unauthorized manner, altered or disclosed. Access to personal information is limited only to those individuals who require access in order to perform their role. Where your personal information is shared with third parties, it will be on instructions from us and they will be under duties of confidentiality and obligations to ensure the security of your personal information.

Unless you become an employee, in which case your personal information will be held in accordance with our Employee Privacy Notice, we will retain your personal information for a period necessary in the event of a legal claim, to show that we have not discriminated against candidates on prohibited grounds and that we have conducted the recruitment exercise in a fair and transparent way and then in line with any legal, accounting, regulatory or reporting requirements that are applicable. After this period, we will securely destroy your personal information in accordance with applicable laws and regulations.

If we wish to retain your personal information on file, on the basis that a further opportunity may arise in future and we may wish to consider you for that, we will contact you separately, seeking your consent to retain your personal information for a fixed period on that basis.

Your rights and obligations

It is important that the personal information we hold about you is kept up to date. Please use the applicable processes to inform us of any updates to your personal information.

When you applied for this role, you provided consent to us processing your personal information for the purposes of the recruitment exercise. You have the right to withdraw your consent for processing for that purpose at any time. To withdraw your consent, please contact the Talent Acquisition Team. Once we have received notification that you have withdrawn your consent, we will no longer process your application and, subject to our retention policy, we will dispose of your personal data securely.

Under certain circumstances and where legislation requires, by law, you have the right to:

Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
Object to processing of your personal information where we are relying on a legitimate interest (or the legitimate interests of a third party) and there is something about your particular situation which makes you want to object to processing on this ground.
Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of your personal information, for example if you want us to establish its accuracy or the reason for processing it.
Request the transfer of your personal information to another party.

If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact the Data Protection Officer in writing.

You are not usually required to pay any charge for exercising your rights, however we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Full details of your rights can be found in the applicable data privacy legislation or by reference to guidance produced by the data privacy regulator in your country.

Data Protection Officer contact details

If you have any questions about this notice or your personal information, then please contact the Data Protection Officer - DataProtectionOfficer@bottomline.com.

You also may have the right to make a complaint to the data privacy regulator in your country.

Changes to this Privacy Notice

We may update this notice at any time. This notice was published on 15 May 2025.

Job Details

Skills Required

More Details

Why Choose Bottomline?

Apply