About the role

HTS Consulting is hiring a Senior GRC Consultant with at least 4 years of hands-on experience in governance, risk and compliance and strong working knowledge of Indian financial sector regulations.

You will lead regulatory compliance and audit engagements for banks, NBFCs, payment system operators, fintechs, stock brokers and their technology service providers, covering RBI, NPCI, SEBI, CERT-In and DPDP Act requirements alongside ISO 27001, ISO 22301 and PCI DSS.

You will own client engagements from scoping to closure, be the main point of contact for client CISOs, compliance and IT teams, review the work of GRC Analysts, and present findings to senior management and board committees. The role is full-time and work from office only in Bangalore (no hybrid or remote option), and we are looking for candidates who can join immediately or within 15 days.

What you will do

Regulatory compliance (RBI, NPCI, SEBI and others)

- Run gap assessments and compliance reviews against RBI directions, including the Master Direction on IT Governance, Risk, Controls and Assurance Practices, the Cyber Security Framework, Outsourcing of IT Services, Digital Payment Security Controls, Payment Aggregator guidelines and Cyber Resilience for PSOs.
- Carry out NPCI compliance reviews and member audits for UPI, IMPS, NACH, AePS, RuPay and BBPS participants, and prepare annual system audit and certification reports.
- Assess SEBI regulated entities against the Cybersecurity and Cyber Resilience Framework (CSCRF) and related circulars, and support cyber audit and VAPT reporting to SEBI and the exchanges.
- Support CERT-In directions (incident reportsync), UIDAI AUA and KUA requirements and DPDPAct compliance programmes.
- Track new regulatory circulars, assess theidate compliance checklists and controllibraries.
- Prepare responses to regulator inspections ns, such as RBI IT examinations and SEBIinspections, and drive Risk Mitigation Plans to closure.

Governance and frameworks

- Design and implement ISMS, BCMS and PIMS programmes aligned to ISO 27001, ISO 22301 and ISO 27701, and support PCI DSS and SOC 2 readiness.
- Draft and review board-approved policies such as information security, cyber security, IT outsourcing, cyber crisis management and business continuity policies.
- Build integrated control frameworks that map RBI, NPCI, SEBI, CERT-In, ISO and PCI DSS requirements to one common set of controls.

Risk, audit and third parties
- Lead IT and cyber risk assessments,



maintain risk registers and present the risk posture to the IT Strategy Committee, Risk Management Committee and senior management.
- Plan and lead internal audits, IS audits and regulatory audits, and write audit reports with risk-rated observations and agreed remediation.
- Run third-party and outsourcing risk assessments in line with RBI and SEBI requirements, including due diligence, contract clauses and periodic reviews.
- Review technical evidence such as access reviews, VAPT and configuration audit reports, SOC and log monitoring, and backup and DR drill results.

Ongoing compliance maintenance

- Maintain a compliance calendar for each client covering regulatory submissions, audits, policy reviews, drills and renewals.
- Run quarterly compliance reviews and periodic control testing, and keep evidence ready for regulator and auditor requests.
- Support management reviews, committee meetings and board reporting with compliance dashboards, KRIs and action trackers.

Engagement leadership and reporting

- Lead client engagements from scoping to closure, manage timelines and deliverables, and be the main contact for client CISOs and compliance heads.
- Review and quality-check the work of GRC Analysts, and mentor them on regulations and audit practice.
- Maintain a tracker of all open gaps, observations and action items, follow up with owners and drive every open point to closure within the agreed timeline.
- Share weekly status reports with clients and a monthly summary for management, and escalate overdue and high-risk items early.

What you bring

- Minimum 4 years of hands-on experience in GRC, IS audit or regulatory compliance, with at least 2 years in BFSI, payments or capital markets.
- Strong working knowledge of RBI cyber security and IT governance directions, and practical exposure to NPCI and SEBI CSCRF requirements.
- Working knowledge of CERT-In and DPDP Act requirements.
- Hands-on experience implementing or auditing ISO 27001, with exposure to ISO 22301, ISO 27701 and PCI DSS.
- Experience leading audits or regulatory assessments and writing clear,



risk-rated reports.
- Good understanding of IT and security controls across infrastructure, applications, cloud, payments and data protection.
- Confident communicator who can present to CISOs, senior management and board committees.
- Experience managing multiple engagements at the same time and mentoring junior team members.
- Disciplined follow-up, with experience tracking open items to closure and sharing regular status reports.
- Immediate joiner or notice period of up to 15 days.
- Able to work from our Bangalore office full-time, as this role has no hybrid or remote option.
- Bachelor's degree in Computer Science, IT, Electronics, Commerce or equivalent, a postgraduate degree is a plus.

Frameworks and tools

- RBI and NPCI: IT Governance Master Direction 2023, Cyber Security Framework, IT Outsourcing Master Direction 2023, Digital Payment Security Controls, PA and PSO guidelines, NPCI UPI and member audit requirements
- SEBI and others: SEBI CSCRF 2024, CERT-In directions 2022, UIDAI AUA and KUA requirements, DPDP Act 2023
- Frameworks: ISO 27001:2022, ISO 22301:2019, ISO 27701:2019, PCI DSS v4.0, SOC 2, NIST CSF
- Risk and audit: Risk registers, control libraries, audit programmes, Risk Mitigation Plans, KRIs, BIA
- GRC and reporting: ServiceNow GRC, MetricStream, Archer or similar, Jira, Excel, PowerPoint, Power BI

Good to have

- Experience working in or with a fintech company (payments, lending, wealth or insurtech) will be a valued advantage.
- Certifications such as CISA, CISM, CRISC, CDPSE, ISO 27001 or ISO 22301 Lead Auditor, or PCI DSS QSA or ISA.
- Experience with a CERT-In empanelled audit firm, a Big 4 firm or an in-house compliance team at a bank, NBFC, payment company or broker.
- Exposure to RBI IT examinations, SEBI inspections or NPCI audits.
- Experience with GRC platforms such as ServiceNow GRC, MetricStream or Archer.

Why HTS Consulting

- Lead regulatory and cyber compliance engagements for banks, NBFCs, payment companies, fintechs and brokers.
- Sponsored certifications (CISA, CISM, CRISC or Lead Auditor) and a training budget.
- A transparent growth path to GRC Lead, Practice Lead and vCISO roles.
- Salary band will be discussed at the time of interview.

How to apply

Apply through LinkedIn, or share your profile with [email protected] with the subject "Senior GRC Consultant – ". Please mention your current CTC, expected CTC and notice period.

📌 Senior GRC Consultant (Bengaluru)
🏢 Horizontal Thinkers
📍 Bengaluru