Senior GRC Analyst

Responsibilities

• Governance
• Develop, review, and maintain security policies, standards, and procedures, ensuring they remain current and aligned with business needs
• Manage the policy exception tracking process, including intake, review, and escalation
• Coordinate policy acknowledgment and sign-off across business units
• Support and help improve the organization's security awareness training program
• Prepare governance metrics and reporting for leadership and board-level stakeholders
• Risk Management
• Own and maintain the enterprise risk register, ensuring risks are accurately documented, scored, and tracked
• Conduct risk assessments for new projects, systems, and vendors, as well as periodic reviews of existing risks
• Facilitate risk scoring and prioritization sessions with business and technical stakeholders
• Track risk treatment plans and follow up with owners to ensure timely remediation
• Manage the third-party vendor risk assessment program, including questionnaires and ongoing monitoring
• Support business impact analysis (BIA) and business continuity planning efforts
• Compliance
• Map and maintain control libraries aligned to frameworks such as NIST CSF, ISO 27001, SOC 2, GDPR
• Coordinate internal and external audit engagements, including evidence collection and stakeholder communication
• Perform control testing and gap assessments, documenting findings and recommending remediation
• Track open audit findings through to closure
• Monitor regulatory and framework changes, assess organizational impact, and recommend updates
• Support data privacy compliance activities related to GDPR, CCPA, or other applicable regulations
• Day-to-Day Operations
• Own and administer the GRC platform (e.g., Archer, Vanta, Drata, ServiceNow GRC), driving adoption and continuous improvement
• Lead responses to complex customer security questionnaires, RFPs, and due diligence requests
• Serve as the compliance lead for incident response activities, ensuring documentation, notification obligations, and regulatory requirements are met
• Act as the primary GRC point of contact for IT, Legal, HR, Finance, and business unit teams — driving control ownership and accountability across the organization

Qualifications

• Bachelor's degree in Information Security, Computer Science, Business, or a related field (or equivalent experience)
• 3-5 years of experience in GRC, IT audit, information security, or a closely related role
• Working knowledge of at least two major compliance frameworks (NIST CSF, ISO 27001, SOC 2, HIPAA, PCI-DSS, etc.)
• Experience collecting audit evidence and managing audit engagements
• Familiarity with GRC tools and platforms
• Strong written communication skills — able to translate technical risk concepts for non-technical audiences
• Highly organized with the ability to manage multiple workstreams and deadlines simultaneously

Nice to Have

Salary Range

• ₹24,00,000 to ₹32,00,000 plus 10% bonus
• As a learning company we believe in the potential of everyone; if you don't have experience in all the details mentioned in this job post, then we still encourage you to apply and we'll get back to you as soon as we can.
• We are an equal opportunity workplace employer. We are committed to the values of Equal Employment Opportunity and provide accessibility accommodations to applicants with physical and/or mental disabilities.
• Applicants will receive consideration for employment without regard to their age, race, religion, national origin, ethnicity, age, gender (including pregnancy, childbirth, et al), sexual orientation, gender identity or expression, protected veteran status, or disability.