We are looking for an experienced Senior GRC Analyst to support information security governance, risk management, compliance, audit readiness, and privacy initiatives. The candidate will be responsible for maintaining GRC documentation, reviewing security controls and audit evidence, coordinating internal and external audits, conducting risk assessments, tracking remediation activities, and ensuring compliance with applicable security and privacy frameworks.
The ideal candidate should have hands-on experience with ISO 27001, SOC 2 Type II, GDPR, DPDPA, and NIST frameworks, along with a strong understanding of security controls, audit requirements, risk management, and privacy compliance. The role requires close collaboration with IT, Legal, Privacy, Procurement, business teams, control owners, auditors, and clients to maintain compliance and continuously improve security and privacy practices.
Key Responsibilities
Support GRC programs across ISO 27001, SOC 2, GDPR, DPDPA, NIST CSF, NIST 800-53, and other applicable security and privacy frameworks.
Maintain and update security policies, standards, procedures, control documentation, risk registers, audit trackers, evidence templates, and compliance reports.
Review security controls and validate audit evidence for completeness, accuracy, relevance, and audit readiness.
Coordinate internal and external audits, including evidence collection, auditor queries, walkthroughs, follow-ups, and remediation tracking.
Support ISO 27001 ISMS activities, including internal audits, Statement of Applicability (SoA), Annex A control evidence, corrective actions, and certification or surveillance audits.
Support SOC 2 Type II readiness and audits by mapping controls to Trust Services Criteria, validating evidence, tracking exceptions, and coordinating remediation.
Conduct information security risk assessments, internal control reviews, and compliance assessments; maintain risk registers and track mitigation plans.
Identify compliance gaps, control deficiencies, exceptions, and corrective actions, ensuring timely closure with relevant stakeholders.
Support GDPR and DPDPA compliance activities, including privacy risk assessments, DPIAs/PIAs, records of processing activities, and data retention reviews.
Review vendor MSAs, SOWs, and contractual documents for information security, confidentiality, data protection, personnel security, and privacy requirements.
Coordinate with Legal, Privacy, IT, Procurement, business teams, and control owners to address regulatory, contractual, and client security obligations.
Support vendor security and privacy reviews, third-party risk management, and client assurance activities.
Prepare audit reports, compliance dashboards, management summaries, risk metrics, and status updates.
Support security awareness initiatives, including role-based training, phishing simulations, repeat-offender tracking, and remedial training.
Identify opportunities to improve GRC processes, strengthen security controls, and enhance audit readiness.
Maintain accurate records of audit evidence, control performance, risk decisions, remediation activities, and compliance status.
Required Skills
5–7 years of experience in GRC, IT audit, information security compliance, risk management, or privacy compliance.
Working knowledge of ISO 27001, SOC 2, NIST CSF, NIST 800-53, GDPR, and DPDPA.
Hands-on experience in audit coordination, control evidence validation, risk assessments, and remediation tracking.
Strong understanding of information security controls, policy governance, regulatory requirements, and compliance documentation.
Excellent analytical, communication, documentation, and stakeholder management skills.
Proficiency in Microsoft Office Suite, including Word, Excel, and PowerPoint.
Preferred Qualifications
Certifications such as CISA, ISO 27001 Lead Auditor/Implementer, CRISC, CISSP, CDPSE, or equivalent.
Experience supporting SOC 2 Type II audits, ISO 27001 certification or surveillance audits, and client assurance reviews.
Familiarity with additional frameworks such as HITRUST, HIPAA, PCI DSS, COBIT, and CIS Controls.
Experience with GRC, audit, risk management, or privacy platforms.
Familiarity with vendor risk management, third-party security assessments, and global shared services environments.
Familiarity with Google Workspace is an added advantage.
