Role Overview

We are looking for a GRC Senior Analyst with 2-3 years of experience to support our information security governance, risk management, compliance, regulatory, and audit activities.

The role will involve working closely with IT, Engineering, DevOps, Product, Risk, Legal, Compliance, Operations, and external auditors to ensure security and regulatory controls are implemented, monitored, documented, and maintained.

The candidate will support compliance requirements related to PCI DSS, PCI 3DS, PCI Secure Software Standard (PCI S3), ISO 27001, SOC 2, RBI regulations, and DPDP requirements.

Key Responsibilities

- Support compliance activities related to:
- PCI DSS
- PCI 3DS
- PCI Secure Software Standard (PCI S3)
- ISO 27001
- SOC 2
- RBI regulatory and cybersecurity requirements
- DPDP Act and related privacy requirements
- Coordinate internal audits, external audits, regulatory assessments, and certification activities.
- Maintain required audit evidence, compliance documentation, and assessment records.
- Maintain ISMS policies, procedures, standards, control documents, risk registers, and compliance trackers.
- Perform periodic control checks and compliance reviews.
- Identify gaps and follow up with responsible teams for timely remediation.
- Support information security risk assessments and track risk-treatment actions.
- Perform and coordinate third-party/vendor security assessments.
- Coordinate VAPT activities, track security findings, follow up on remediation, and maintain closure evidence.
- Support PCI-related activities such as scope validation, evidence collection, control implementation tracking, and auditor coordination.
- Support PCI 3DS and PCI Secure Software Standard compliance activities, where applicable.
- Track and support applicable RBI regulations,



cybersecurity directions, data-localization requirements, payment-security controls, and regulatory observations.
- Support DPDP compliance activities, including security and privacy-control documentation where applicable.
- Assist with security exception management, risk acceptance, and compensating-control documentation.
- Maintain compliance calendars and ensure periodic assessments, reviews, renewals, and evidence submissions are completed on time.
- Prepare management reports, compliance dashboards, audit-status updates, and remediation trackers.
- Work with technical teams to understand security findings and ensure required evidence is available for audits.
- Support awareness and internal coordination for security and compliance requirements.
- Maintain documentation required for internal and external stakeholder reviews.
- Track security and compliance observations until formal closure.

Required Skills

- 2-3 years of experience in Information Security, GRC, IT Audit, Cybersecurity, Risk, or Compliance.
- Working knowledge of PCI DSS, ISO 27001, SOC 2, and RBI cybersecurity and regulatory requirements.
- Understanding of PCI 3DS and PCI Secure Software Standard / PCI S3 will be an advantage.
- Understanding of risk assessment, control testing, audit evidence, compliance documentation, and remediation tracking.
- Experience coordinating internal and external audits.
- Ability to maintain policies,



procedures, risk registers, control trackers, and audit evidence.
- Understanding of information-security governance and risk-management concepts.
- Knowledge of vendor/third-party risk management.
- Basic understanding of VAPT and vulnerability remediation processes.
- Strong documentation, communication, and stakeholder-management skills.

Good to Have

- Experience in Fintech, Payments, Banking, or Financial Services.
- Exposure to payment-security and RBI regulatory requirements.
- Familiarity with PCI DSS certification and assessment processes.
- Exposure to PCI 3DS assessments and PCI Secure Software Standard requirements.
- Basic understanding of AWS/cloud security, IAM, network security, and application security.
- Exposure to GRC tools such as ServiceNow GRC, Archer, MetricStream, or equivalent platforms.
- Understanding of DPDP, privacy, data-protection, and data-localization requirements.
- Experience supporting regulatory audits, client audits, and certification assessments.

Preferred Certifications

- ISO 27001 Lead Auditor
- ISO 27001 Lead Implementer
- CISA
- CISM
- CompTIA Security+
- PCI-related certifications or training
- Equivalent Information Security / GRC certification

Candidate Profile

- Robust in documentation and compliance coordination
- Comfortable working with auditors, technical teams, management, and external stakeholders
- Able to manage multiple audit and compliance activities simultaneously
- Detail-oriented and capable of maintaining accurate evidence and records
- Proactive in tracking and closing compliance gaps
- Interested in building strong information-security governance and regulatory compliance within a Fintech / Payments environment.

📌 GRC Senior Analyst (Chennai)
🏢 Mylapay
📍 Chennai