GRC Cybersecurity Specialist – ConsultingExperience: Above 5 years of experience

Location:
Delhi NCR Employment type: Full-time Working arrangement: Office and client-site working, with travel as required for consulting engagements (Global & India) Role DescriptionWe are hiring a GRC Cybersecurity Specialist to deliver client engagements across cybersecurity audits, IT governance, technology risk, regulatory compliance, information security management, and data privacy. The role requires practical experience in assessing security controls, identifying gaps, supporting framework implementation, and preparing clear, actionable reports. The specialist will work closely with client business, IT, information security, risk, and compliance teams, managing assigned workstreams from planning and assessment through reporting and remediation follow-up.

Key Responsibilities
• Cybersecurity and IT audits: Conduct cybersecurity audits, IT General Controls (ITGC) reviews, IT Application Controls (ITAC) assessments, and technology risk assessments. Evaluate access management, change management, IT operations, infrastructure security, cloud security, third-party security, and business continuity controls.
• ISO audits and implementation: Support ISO/IEC 27001 implementation, gap assessments, risk assessments, internal audits, certification readiness, and ongoing Information Security Management System (ISMS) improvement. Develop policies, procedures, risk treatment plans, Statements of Applicability, and supporting evidence.
• Regulatory assessments: Conduct or support regulatory cybersecurity and IT compliance reviews against applicable RBI, SEBI,



IRDAI, CERT-In, and other sector-specific requirements, based on the client’s industry and engagement scope.
• Data privacy: Support DPDP and GDPR readiness assessments and implementation activities, including personal data inventories, data flow mapping, privacy notices, consent processes, retention practices, data principal/data subject rights workflows, and third-party privacy reviews.
• Framework assessments: Assess and map controls against relevant global frameworks and standards, including NIST CSF, NIST SP 800-53, CIS Controls, ISO/IEC 27001, and ISO/IEC 27701.
• Control testing and evidence review: Conduct stakeholder interviews, walkthroughs, sample-based testing, and reviews of policies, system configurations, access records, logs, and other audit evidence.
• Reporting and remediation: Prepare risk-rated findings, explain business impact, recommend practical corrective actions, and track remediation through evidence-based closure.
• Client delivery: Lead assigned client discussions, coordinate evidence requests, communicate progress and dependencies, and present findings to technical teams and management.
• Consulting support: Contribute to proposals, scope documents, assessment checklists, presentations,



and internal knowledge development.
• Small Team Handling: Able to assign & handle team of cyber folks for engagements Required Skills and Experience
• Approximately 5 years of relevant experience in cybersecurity GRC, IT audit, information security consulting, technology risk, or regulatory compliance.
• Practical experience delivering cybersecurity audits and ISO/IEC 27001 audit or implementation engagements.
• Exposure to regulatory audits or compliance assessments involving RBI, SEBI, and/or IRDAI requirements.
• Working knowledge of India’s DPDP framework, GDPR, and global information security frameworks.
• Ability to assess technical controls across applications, databases, operating systems, networks, cloud environments, and security tools.
• Experience in risk assessment, control testing, audit documentation, policy development, and remediation tracking.
• Robust report-writing, presentation, stakeholder management, and client communication skills.
• Ability to manage multiple assignments, meet deadlines, and work from both office and client locations. Qualifications and Preferred Credentials
• Bachelor’s degree in Information Technology, Computer Science, Information Security, Engineering, or a related discipline.
• Relevant certifications such as CISA, CIPP, CISM, CRISC, CISSP, ISO/IEC 27001 Lead Auditor, or Lead Implementer are preferred.
• Prior consulting experience and exposure to banking, NBFCs, insurance, securities markets, or other regulated industries will be an advantage

📌 GRC Cyber Specialist (India)
🏢 Acquisory
📍 India