DevSecOps for India teams.
Security in the pipeline, not after the audit fails.
Most "security" in Indian SaaS is bolted on the week before SOC 2 audit week. We make security a property of the pipeline — IaC scanning before merge, SAST/DAST in CI, container image scanning before push, runtime detection in production. By the time an auditor looks, evidence already exists.
Serving: Pan-India · Global remote
Concrete deliverables for India (remote) clients.
- IaC scanning in CI — Checkov, tfsec, KICS for Terraform and CloudFormation
- SAST in CI — Semgrep, SonarQube, GitHub Advanced Security
- SCA — dependency scanning with Snyk, Dependabot, Trivy
- Container image scanning at build and at registry (Trivy, Grype)
- Secret detection (Gitleaks, TruffleHog) on every commit + historical scan
- Runtime security in K8s with Falco + custom rules for your workload
- Cloud security posture (CSPM) — Prowler for AWS, custom policies for Azure / GCP
- Compliance evidence pipeline — SOC 2, ISO 27001, DPDP Act, CERT-In
Local context, not boilerplate.
For Indian SaaS companies selling to US/EU customers, SOC 2 Type 1 is now table stakes — and most teams realise this 6 weeks before a deal closes. We can get a typical 30-engineer team SOC 2 Type 1 ready in 8 weeks, by automating the evidence collection that auditors otherwise want manually.
CERT-In incident reporting (6-hour rule), DPDP Act controller obligations, and RBI cloud guidelines now overlap in inconvenient ways. We have a working policy + control template that maps a single set of automated controls to all four frameworks (SOC 2 + ISO 27001 + DPDP + CERT-In) so you don't implement four times.
Most Indian DevSecOps engagements add tooling but never tune it — SAST that flags 4,000 issues nobody fixes is worse than no SAST. We tune the noise out, set sane severity thresholds, and route findings to the right team's ticket queue. By month 3 the false-positive rate is under 5%.
Questions India (remote) clients ask first.
- Can you support our SOC 2 audit?
- Yes — we partner with multiple SOC 2 / ISO 27001 auditors and have a standard 8-week readiness programme. We do not perform the audit ourselves (that would be a conflict). We prepare the evidence, controls, and policies; an independent CPA firm signs off.
- What about DPDP Act compliance?
- Yes. DPDP-specific controls (data classification, consent management, breach notification, cross-border transfer assessment) are part of our standard implementation. We map them to your existing SOC 2 / ISO 27001 controls so you don't duplicate work.
- Do you handle CERT-In incident response?
- Yes — incident response runbooks include the CERT-In 6-hour reporting workflow with templated communication. We do not do legal filings on your behalf, but the data + draft notifications are pre-prepared so your CISO/legal can submit within window.
- What if we're too small for SOC 2 yet?
- Then you don't need it yet. We'll set up the foundational controls (IaC scanning, SAST, secret scanning, IAM least-privilege) so when you do need SOC 2 in 12-18 months, you're already 70% of the way there.
Same team, other cities and tracks.
Talk to a senior engineer.
30-min architecture review · written assessment within 48h · no commitment.