Job highlights

- Experience with PCI, ISO audits and GRC tools administration
- Support GRC and PCI compliance, perform gap and deficiency analysis, manage remediation, collaborate with IT and business units, lead control integration efforts

Compliance Analyst : JD

Job Summary

This job is responsible/accountable for supporting the processes and objectives of the

Governance, Risk, and Compliance (GRC) function and Payment Card Industry (PCI)

Compliance Program within the Information Security department.

Responsibilities and Duties Experience - Experience with audits, controls, and PCI and/or ISO requirements - Experience administering and creating workflows in GRC tools - Experience working in a highly-regulated environment The Compliance Analyst should ensure the existence of appropriate security governance within the DC and Cloud and internally controlled environments (policy, procedures, baselines and monitoring); assessment of required controls, and testing of adherence to required policies,

procedures and monitoring.

The Information Security Compliance Analyst will collaborate with other members of the Security and IT teams to define appropriate and effective information security controls and will work with the various business units to implement them.

The Information Security Compliance Analyst will also be responsible for performing gap analysis exercises while working collaboratively with Functional Business Unit and IT teams to implement required remediation effectively.

Essential functions for this role include: Perform a deficiency analysis and implement required controls to meet IT Policy and Regulatory Compliance requirements in a cloud environment.





Escalate and resolve risks and issues as required.

Communicate the compliance effectiveness to Management on a scheduled basis. Test for adherence to policy and regulatory controls, procedures and standards.

Prepare for engagement reviews and quality assurance activities. Follow up on deficiencies identified in monitoring reviews, self-assessments, automated assessments, and internal and external audits to ensure appropriate remediation measures have been achieved timely.

Perform impact analysis as needed where controls fail or are considered ineffective.

Track mitigation steps and ensure that risks are managed appropriately and in a timely manner.

Assist with other GRC activities as required. Provide ongoing guidance and consultation to the organization to promote a progressive and sustainable GRC compliance initiative.

Assist with integrating policy and regulatory compliance requirements into the organizations processes (e.g., change control, mergers and acquisitions) and life cycle activities.

Manages timelines, resources, project plans, action item logs, status reports and statistics to ensure milestones, goals and commitments are met.

Work closely with both Internal and External audit teams. Lead control integration efforts with new or existing systems and supporting architecture





Qualifications and Skills - Working knowledge with IT security, compliance, and regulatory requirements, such as: Payment Card Industry (PCI) Data Security Standard (DSS),

Sarbanes-Oxley (SOX), Healthcare Information Privacy Protection Act (HIPPA), state and

Federal privacy laws - Advanced knowledge of IT security concepts.

Preferred - Certified Information Systems Auditor (CISA) - GIAC Security Essentials (GSEC) -

Other Governance, Risk, Compliance, Audit, or Security certifications Participate and be an integral component of audit, compliance, and regulatory functions, including and not limited to:

Payment Card Industry (PCI) Data Security Standard (DSS), Sarbanes-Oxley (SOX), emerging state and Federal privacy laws, and general security auditing Participate in a vulnerability management program that includes: external and internal vulnerability scans of applications and systems, external and internal penetration tests of applications and systems, the documenting and remediation of identified vulnerabilities and exploits, routinely monitoring various communication avenues for security vulnerabilities and security patches, taking a risk based approach comparing those security vulnerabilities and security patches across the operating setting, and making recommendations to various IT teams on the mitigation process for those identified security vulnerabilities Participate and represent the organizations security interests in third party and customer contract reviews Facilitate and manage the policy exception,

risk acceptance, policy management and other GRC

📌 Compliance Analyst (Bengaluru)
🏢 HCLTech
📍 Bengaluru