Position: L2 GRC Analyst / Information Security Auditor

Experience: 3–4 Years

Department: Cybersecurity – Governance, Risk & Compliance (GRC)

Employment Type: Full-TimeWork Arrangement: Onsite / Client Location, as required

Job Summary

We are looking for an experienced Governance, Risk and Compliance (GRC) professional with 3–4 years of hands-on experience in information security audits, risk assessments and regulatory compliance.The ideal candidate should be capable of independently managing client audit engagements, conducting onsite assessments, reviewing security controls, identifying compliance gaps and preparing detailed audit reports.The role requires strong technical understanding, client coordination skills and the ability to manage multiple audit assignments.

Key responsibilities

- Information Security Audits & Assessments

- Conduct information security audits, IT general controls (ITGC) reviews, internal audits and compliance assessments.
- Independently conduct onsite client audits, walkthroughs and stakeholder interviews.
- Review IT infrastructure, applications, security configurations and organisational security controls.
- Identify security risks, control weaknesses and compliance gaps.
- Prepare audit observations, risk ratings, recommendations and final assessment reports.

2. Governance, Risk & Compliance
- Perform assessments against ISO/IEC 27001, SOC 2, RBI guidelines and other applicable regulatory frameworks.
- Conduct risk assessments, gap analyses and security control evaluations.
- Review information security policies, procedures, standards and supporting documentation.
- Assist clients in developing and improving information security governance and compliance programmes.
- Track audit findings and support remediation validation and closure.

3. Audit Documentation & Reporting
- Prepare audit plans, checklists,



evidence request lists and working papers.
- Collect, review and validate audit evidence provided by clients.
- Maintain audit trackers, risk registers, compliance matrices and evidence repositories.
- Draft comprehensive audit reports with explicit findings and actionable recommendations.
- Present assessment results to internal stakeholders and client teams.

4. Client Engagement & Coordination
- Act as a point of contact for assigned audit engagements.
- Coordinate with client IT, infrastructure, application, security and management teams.
- Independently manage onsite audit activities and evidence collection.
- Conduct meetings, follow up on pending evidence and communicate audit progress.
- Manage assigned deliverables within agreed timelines.

Required Skills & Experience

- 3–4 years of relevant professional experience in GRC, IT audits, information security assessments or regulatory compliance.
- Practical experience in ISO/IEC 27001 audits and implementation assessments.
- Working knowledge of SOC 2 Trust Services Criteria and ITGC controls.
- Familiarity with RBI cybersecurity and IT governance requirements.
- Understanding of network security, operating systems, cloud environments, identity and access management, vulnerability management, backup and disaster recovery.
- Experience in identifying audit gaps and preparing professional audit reports.
- Strong documentation, analytical and communication skills.




- Ability to conduct client audits independently with minimal supervision.
- Willingness to travel and work onsite at client locations when required.

Preferred / Additional Skills

- Knowledge of SEBI CSCRF, CERT-In directions, the DPDP Act and other relevant Indian regulatory requirements.
- Exposure to third-party risk assessments and vendor security reviews.
- Familiarity with NIST CSF, CIS Controls and ISO 22301.
- Experience auditing AWS, Azure, Microsoft 365 or Google Workspace environments.
- Understanding of security monitoring, incident management, vulnerability assessments and penetration testing reports.
- Experience working with clients in BFSI, fintech, technology or other regulated industries.
- Independently conduct onsite client audits, walkthroughs and stakeholder interviews.
- Review IT infrastructure, applications, security configurations and organisational security controls.
- Identify security risks, control weaknesses and compliance gaps.
- Prepare audit observations, risk ratings, recommendations and final assessment reports.

Educational Qualifications

- Bachelor's degree in Computer Science, Information Technology, Cybersecurity or a related discipline.
- Relevant certifications such as ISO 27001 Lead Auditor, ISO 27001 Lead Implementer, CISA, CRISC or equivalent are preferred.

Key Expectations

- Ability to independently handle information security audit engagements.
- Comfortable working directly with clients and travelling for onsite assessments.
- Strong understanding of audit methodologies and regulatory requirements.
- Ability to produce accurate, evidence-based audit observations and reports.
- Strong ownership, accountability and time-management skills.

Pay: ₹800,000.00 - ₹1,200,000.00 per year

Benefits

- Health insurance
- Provident Fund

Work Location: In person

📌 GRC Analyst (Hyderabad)
🏢 Entersoft Informations
📍 Hyderabad