Business Analyst Information Security Governance, Risk & Compliance (GRC) - Requirements & Analysis Role Purpose Bridge business and regulatory stakeholders and the technical delivery team within the Information Security Governance, Risk, Compliance & Assurance (GRC) domain.

The Business Analyst elicits, analyzes, and documents requirements; owns the Business Requirements Document (BRD); and translates regulatory, control, evidence, risk, and workflow needs into clear user stories, acceptance criteria, and process designs for AI-enabled GRC solutions.

Key Responsibilities Requirements ownership: Own, refine, and maintain the BRD and a clear requirements traceability matrix from business need through to delivered capability. Elicitation: Run workshops and interviews with GRC, Risk, Audit, Compliance, and Information Security SMEs and business control owners to capture detailed requirements. Process analysis: Document current-state vs target-state processes for compliance execution, risk assessment, audit readiness, and evidence management; identify gaps and improvement opportunities. Control framework & taxonomy: Support definition and alignment of standardized control frameworks and taxonomies; map controls across regulations and standards (e.g., ISO 27001, NIST, relevant central-bank requirements). Capability requirements: Specify requirements for regulatory ingestion (NLP), intelligent control mapping, workflow orchestration, the evidence lifecycle and reuse rules, risk assessment engines, and executive dashboards/reporting. Backlog & user stories: Write user stories with clear acceptance criteria and, with the Product Owner,



groom and prioritize the backlog - helping focus proof-of-concept and MVP scope on high-value use cases. Functional & non-functional requirements: Capture NFRs including role-based access control, audit logging, scalability, and integration with SIEM, IAM, and Dev

SecOps systems. Vendor fit/gap analysis: Support build buy hybrid evaluation through structured fit/gap analysis of candidate platforms (e.g., Service

Now GRC, RSA Archer, Metric

Stream, One

Trust) against business requirements. Data requirements: Define data requirements and quality expectations needed to train and operate AI/NLP models, in partnership with Data and ML Engineers. Validation & UAT: Develop test scenarios and acceptance criteria, support QA and User Acceptance Testing, and confirm delivered features meet documented requirements. Change & sign-off: Manage requirement change requests, facilitate stakeholder reviews, and obtain formal sign-offs at each stage gate.

Required Qualifications & Experience Bachelor's degree in Business, Information Systems, Computer Science, or a related field.

Page 1 of 2 Information Security Governance, Risk & Compliance (GRC) Confidential Business analysis certification preferred - CBAP, CCBA, PMI-PBA, or an Agile BA / Scrum credential. 5+ years of business-analysis experience, including delivery in GRC, risk, compliance, or information security - ideally in financial services.



Strong requirements elicitation, process modeling (e.g., BPMN), use-case and user-story authoring. Experience producing BRDs, functional specifications, and requirements traceability. Experience supporting vendor evaluation and fit/gap analysis against documented requirements.

Technical & Domain Knowledge Working knowledge of GRC platforms and control frameworks (ISO 27001, NIST; awareness of central-bank regulatory expectations). Understanding of compliance, risk-assessment, audit-readiness, and evidence-management processes. Familiarity with AI/ML and NLP concepts and the data requirements that support them (preferred). Comfort with backlog and analysis tooling (e.g., Jira / Azure Dev

Ops) and process-modeling tools.

Core Competencies Exceptional written documentation and analytical rigor with strong attention to detail. Skilled facilitator able to translate between business, regulatory, and technical audiences. Structured, requirements-led thinking and the ability to prioritize for value. Collaborative, proactive, and comfortable operating amid evolving requirements.

Preferred (Nice to Have) Experience in banking or financial services within the UAE / GCC region. Prior exposure to AI/ML or NLP projects and to agile delivery.

Success Measures Explicit, complete, and traceable requirements that the delivery team can build against with minimal rework. Well-prioritized scope focused on high-value, defensible use cases. Accurate control mapping and evidence/workflow requirements that reduce duplication and support reuse. Successful UAT and stakeholder sign-off at each stage gate.

📌 Business Analyst - Virtusa (India)
🏢 TRIGENT SOFTWARE PRIVATE
📍 India