Job description :

KrazyBee is hiring a Senior GRC Specialist to own and evolve our security governance, risk and compliance function. This is a builders role. You will shape the GRC strategy, lead a team, and be the main voice on security regulation for a fast-growing fintech lender.

What you will do

- Own the GRC strategy, roadmap and operating model, aligned to business goals and risk appetite
- Build and mentor a team of GRC analysts and specialists, with clear KRAs and career paths
- Run the ISMS under ISO 27001 and NIST CSF, including certification and recertification cycles
- Maintain the risk register and risk treatment plans, with SLAs for risk owners
- Act as the main liaison with RBI, UIDAI, NPCI and CERT-In, and handle examinations, queries and circular implementation
- Lead compliance across RBI IT Framework, PCI DSS, ISO 27001, SOC 2 Type II, DPDPA and UIDAI AUA/KUA guidelines
- Quantify cyber risk in financial terms (e.g., FAIR) for leadership and Board reporting
- Govern the cyber insurance program, BCP and DR testing, and operational resilience
- Run the third-party risk program: vendor tiering, due diligence, contract annexures and ongoing monitoring
- Set up continuous control monitoring and own the internal audit relationship
- Oversee VAPT, red team exercises and cloud security reviews, and track vulnerabilities to verified closure




- Lead security awareness and phishing simulation programs, and partner with HR and Legal on employee lifecycle controls
- Own GRC tooling strategy and automate evidence collection and control testing

What we are looking for

- 8 to 10 years in Information Security GRC, with at least 4 years in a leadership or program management role
- Experience in a regulated fintech, BFSI or technology company
- Delivered ISO 27001, SOC 2 and PCI DSS programs from the ground up
- Hands-on experience dealing directly with RBI, UIDAI or NPCI and handling regulatory examinations
- Good understanding of AWS and GCP security and compliance tooling (Security Hub, Security Command Center)
- Robust written communication for policies, regulatory correspondence, audit reports and board papers
- Able to influence engineering, product, legal and finance teams without direct authority

Preferred certifications: CISSP, CISM, CISA, CRISC, ISO 27001 Lead Implementer or Lead Auditor. PCI-DSS QSA or ISA is a strong plus.

Why join us
You will inherit a solid compliance foundation and have the backing and runway to build a best-in-class GRC function. Your work will feed board-level decisions and help serve millions of underserved borrowers across India.Role & responsibilities

Preferred candidate profile

📌 Senior GRC Specialist (Information Security) (Bengaluru)
🏢 Krazy Bee Services
📍 Bengaluru