Role Summary :

We are seeking a seasoned Senior Governance, Risk, and Compliance (GRC) Analyst / Specialist with approximately 5 years of experience to lead and execute our core information security governance, risk management, and compliance operations.

In this role, you will own day-to-day GRC operations, acting as the primary operational point of contact for assurance activities. You will collaborate closely with internal engineering, IT, security operations, product, and legal teams, as well as external vendors. The ideal candidate is a self-starter who can drive continuous improvement, automate manual processes, and elevate the organizations overall security and compliance posture.

Key Responsibilities :

1. Risk Management &

- Governance :
- Maintain the enterprise and operational risk registers, conducting risk assessments across business and technology functions.
- Track risk treatment plans, monitor mitigation activities, and ensure the timely closure of identified risks.
- Prepare GRC and security metrics, dashboards, and management reports, tracking key performance indicators (KPIs) and key risk indicators (KRIs).

2. Third-Party Risk Management (TPRM) :

- Manage end-to-end TPRM activities, including vendor onboarding assessments, due diligence reviews, and periodic reassessments.
- Review vendor security questionnaires, audit reports (SOC 2, ISO), certifications, and remediation plans.
- Maintain vendor risk registers, track outstanding findings, and monitor risk closure.

3. Compliance, Audit, &

- Control Monitoring :
- Perform control monitoring and effectiveness reviews to validate compliance with internal policies, ISO 27001, and regulatory obligations (e.g., RBI compliance).
- Support internal and external audits by coordinating evidence collection, responding to auditor requests, and tracking remediation actions.
- Manage customer security assessments, due diligence requests, and security questionnaire responses.

4. Identity &

- Access Governance (IAM) &
- Asset Management :




- Coordinate periodic user access, privileged access, and single sign-on (SSO) reviews.
- Validate user provisioning, deprovisioning, role changes, and segregation of duties (SoD) controls.
- Conduct periodic asset inventory reviews to ensure asset ownership, classification, and lifecycle compliance; drive remediation for unmanaged or orphaned assets.

5.

Incident

Management/SOC :

- Monitor security alerts generated by SOC, SIEM, and application logs, coordinating with relevant technical teams for investigation and remediation.
- Track security incidents, document findings, monitor corrective actions, and escalate critical risks.
- Govern the vulnerability management process, tracking remediation timelines and reporting overdue vulnerabilities.

6.

Security

Operations :

- Conducting periodic hardening review of cloud, servers, endpoints and network devices.
- Performing patch compliance review for endpoints on periodic basis.

Qualifications :

Required Qualifications :

- Education: Bachelors degree in information security, Computer Science, Risk Management, or a related technical field.
- Experience: Approximately 5 years of dedicated experience in GRC, Information Security, Risk Management, Security Operations, IAM, and RBI compliance.
- Frameworks: Robust foundational knowledge of security standards and frameworks, specifically ISO 27001, ISO 22301, SOC 2, NIST CSF, and CIS.
- Technical Familiarity: Hands-on experience working with SIEM platforms, security monitoring tools, and vulnerability management governance.
- Soft Skills: Excellent stakeholder management, cross-functional collaboration, and strong documentation/reporting skills (advanced MS Excel/Word).

Preferred Qualifications :

- Certifications: ISO 27001 Lead Implementer / Lead Auditor, CISA, CRISC, or security-specific certifications.
- Industry Experience: Prior experience working within NBFC, PPI, SaaS, FinTech, or fast-paced product-based organizations in regulated industry.
- Cloud Governance: Direct exposure to cloud security governance, preferably within Amazon Web Services (AWS) environments.

📌 True Credits - Senior GRC Analyst/Specialist - Information Security (India)
🏢 TRUE CREDITS PRIVATE
📍 India