GRC Analyst

About This Role

Working as a GRC Analyst, you will own control implementation, evidence collection, risk register maintenance, and audit coordination across a dense multi-framework compliance stack. This role involves close collaboration with AppSec, DevOps/Infra, and client-facing InfoSec teams to maintain certifications and ensure continuous audit readiness.

Responsibilities

• Maintain the Statement of Applicability (SoA), risk treatment plan, and control implementation evidence for ISMS Ownership & Certification Maintenance (ISO/IEC 27001:2022)
• Support internal audits, management review meetings, and surveillance/recertification audits with external certification bodies
• Maintain the Privacy Information Management System (PIMS) extension to the ISMS for Privacy Management (ISO/IEC 27701 + DPDP Act 2023)
• Maintain Records of Processing Activities (ROPA), consent-flow mapping, and data-principal-rights handling against DPDP Act 2023 obligations
• Support Data Protection Impact Assessments (DPIAs) for new features, products, and vendors handling personal data
• Maintain ITSM process documentation—incident, problem, change, capacity, and service level management—aligned to ISO/IEC 20000-1 requirements for IT Service Management
• Coordinate with DevOps/Infra on service management metrics and supporting audit evidence
• Maintain Trust Services Criteria control matrices (security, availability, confidentiality, and processing integrity/privacy where applicable) for SOC 2 Readiness & Audit Support
• Coordinate auditor evidence requests across SOC 2 Type I and Type II engagements
• Maintain Attestation of Compliance (AoC) / Report on Compliance (RoC) documentation and BAU evidence (Requirements 1–12) for PCI DSS v4.0.1 Compliance
• Track compensating controls, quarterly ASV scan remediation, and annual penetration test finding closure alongside the AppSec team
• Maintain the enterprise risk register; run risk assessments for new projects, products, and vendor/third-party integrations for Risk & Third-Party Risk Management
• Support responses to client-facing vendor security questionnaires from banking clients
• Draft and maintain InfoSec policies, standards, and procedures; run security awareness training and track completion metrics for Policy, Awareness & Change Governance
• Provide GRC input into the PCCB (internal change control gate) process for compliance-impacting changes
• Support RBI regulatory reporting and CERT-In incident reporting timelines where GRC input is required for Regulatory Reporting & Metrics
• Build and maintain compliance dashboards/KPIs for leadership and board-level reporting

Requirements

• Bachelor's degree in Information Security, IT, Law, Business, or a related field