REQUIREMENT

- 3-6+ years in GRC, IT audit, information security, risk, compliance, or cybersecurity consulting.
- Hands-on experience with ISO 27001:2022 and SOC 2.
- Solid experience in:
- Risk assessments
- Risk register management
- Security/compliance exception management
- Internal audits
- Control testing
- Audit evidence management
- Remediation tracking

- Understanding of SaaS and cloud security, including Azure and AWS.
- Good understanding of IAM, endpoint security, vulnerability management, incident response, backup/DR, change management, and secure SDLC controls.
- Ability to assess technical controls and translate technical weaknesses into business and compliance risks.
- Strong documentation, analytical, communication, and stakeholder-management skills.
- Working knowledge of privacy and data-protection requirements across multiple jurisdictions.

PREFERRED
- ISO 27001 Lead Auditor / Lead Implementer
- CISA, CRISC, CISSP, CISM, or equivalent SOC 2 Type II experience
- ISO 27701 / privacy compliance experience
- Experience with GRC platforms such as ServiceNow GRC, Archer, OneTrust, Drata, Vanta, Secureframe, or equivalent
- Third-party risk management experience
- Experience supporting global SaaS customers and enterprise security assessments

- Monitor outstanding risks, exceptions, audit findings, and remediation actions and drive them to timely closure.
- Conduct internal audits and control assessments against ISO 27001 and SOC 2 requirements.
- Test the design and operating effectiveness of security controls and identify gaps, exceptions, and non-conformities.
- Maintain audit evidence and ensure controls remain audit-ready throughout the year.
- Maintain the ISO 27001 Statement of Applicability (SoA), control library, policies, procedures, risk register, audit plans, and compliance documentation.
- Map controls to applicable privacy and cybersecurity requirements across India,



Singapore, Malaysia, UAE, and Hong Kong.
- Perform regulatory and privacy gap assessments and track remediation.
- Support assessments relating to data protection, data retention, access control, cross-border data transfers, incident/breach management, and third-party processing.
- Conduct third-party/vendor risk assessments and review SOC reports, ISO certificates, DPAs, security questionnaires, and related evidence.
- Support ISO 27001 surveillance/recertification and SOC 2 Type II audits.
- Prepare management reports covering risk posture, open exceptions, audit findings, compliance status, overdue remediation, and key control gaps.
- Work closely with Security, IT, Engineering, Cloud, Legal/Privacy, HR, and business teams to ensure identified risks and compliance gaps are addressed.
- Maintain the ISO 27001 Statement of Applicability (SoA), control library, policies, procedures, risk register, audit plans, and compliance documentation.
- Map controls to applicable privacy and cybersecurity requirements across India, Singapore, Malaysia, UAE, and Hong Kong.
- Perform regulatory and privacy gap assessments and track remediation.
- Support assessments relating to data protection, data retention, access control, cross-border data transfers, incident/breach management, and third-party processing.
- Conduct third-party/vendor risk assessments and review SOC reports, ISO certificates, DPAs, security questionnaires, and related evidence.
- Support ISO 27001 surveillance/recertification and SOC 2 Type II audits.
- Prepare management reports covering risk posture, open exceptions, audit findings, compliance status, overdue remediation, and key control gaps.

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.

📌 GRC ANALYST- CYBERSECURITY & COMPLIANCE (Chennai)
🏢 MAJULAH INFOTECH
📍 Chennai