Senior GRC Analyst

We are seeking an experienced and strategic Senior GRC Analyst to join our information security team. With 3-5  years of hands-on experience, you will serve as a subject matter expert across governance, risk, and compliance — owning critical programs, driving process maturity, and acting as a trusted advisor to leadership and cross-functional stakeholders. This role goes beyond execution; you will shape the direction of our GRC program and ensure the organization's risk and compliance posture keeps pace with an evolving regulatory and threat landscape.

Responsibilities

Governance

• Develop, review, and maintain security policies, standards, and procedures, ensuring they remain current and aligned with business needs

• Manage the policy exception tracking process, including intake, review, and escalation

• Coordinate policy acknowledgment and sign-off across business units

• Support and help improve the organization's security awareness training program

• Prepare governance metrics and reporting for leadership and board-level stakeholders

Risk Management

• Own and maintain the enterprise risk register, ensuring risks are accurately documented, scored, and tracked

• Conduct risk assessments for new projects, systems, and vendors, as well as periodic reviews of existing risks

• Facilitate risk scoring and prioritization sessions with business and technical stakeholders

• Track risk treatment plans and follow up with owners to ensure timely remediation

• Manage the third-party vendor risk assessment program, including questionnaires and ongoing monitoring

• Support business impact analysis (BIA) and business continuity planning efforts

Compliance

• Map and maintain control libraries aligned to frameworks such as NIST CSF, ISO 27001, SOC 2, GDPR

• Coordinate internal and external audit engagements, including evidence collection and stakeholder communication

• Perform control testing and gap assessments, documenting findings and recommending remediation

• Track open audit findings through to closure

• Monitor regulatory and framework changes, assess organizational impact, and recommend updates

• Support data privacy compliance activities related to GDPR, CCPA, or other applicable regulations

Day-to-Day Operations

• Own and administer the GRC platform (e.g., Archer, Vanta, Drata, ServiceNow GRC), driving adoption and continuous improvement 

• Lead responses to complex customer security questionnaires, RFPs, and due diligence requests 

• Serve as the compliance lead for incident response activities, ensuring documentation, notification obligations, and regulatory requirements are met 

• Act as the primary GRC point of contact for IT, Legal, HR, Finance, and business unit teams — driving control ownership and accountability across the organization

Qualifications

• Bachelor's degree in Information Security, Computer Science, Business, or a related field (or equivalent experience)

• 3-5 years of experience in GRC, IT audit, information security, or a closely related role

• Working knowledge of at least two major compliance frameworks (NIST CSF, ISO 27001, SOC 2, HIPAA, PCI-DSS, etc.)

• Experience collecting audit evidence and managing audit engagements

• Familiarity with GRC tools and platforms

• Strong written communication skills — able to translate technical risk concepts for non-technical audiences

• Highly organized with the ability to manage multiple workstreams and deadlines simultaneously

Nice to Have

• Relevant certifications: CompTIA Security+, CISA, ComptTIA CC, CRISC, CGEIT, or CCSP

• Experience with cloud environments (AWS, Azure, GCP) and cloud security frameworks

• Exposure to data privacy regulations (GDPR, CCPA)

• Experience responding to customer security questionnaires

• Experience with AI laws and regulations

Salary Range: ₹24,00,000 to ₹32,00,000 plus 10% bonus