GRC Analyst

About This Role

This Senior Governance, Risk, and Compliance (GRC) Analyst / Specialist role focuses on leading and executing core information security governance, risk management, and compliance operations. You will own day-to-day GRC operations, acting as the primary operational point of contact for assurance activities. The ideal candidate is a self-starter who can drive continuous improvement, automate manual processes, and elevate the organization's overall security and compliance posture.

Responsibilities

• Maintain the enterprise and operational risk registers, conducting risk assessments across business and technology functions
• Track risk treatment plans, monitor mitigation activities, and ensure timely closure of identified risks
• Prepare GRC and security metrics, dashboards, and management reports, tracking KPIs and KRIs
• Manage end-to-end TPRM activities, including vendor onboarding assessments, due diligence reviews, and periodic reassessments
• Review vendor security questionnaires, audit reports (SOC 2, ISO), certifications, and remediation plans
• Maintain vendor risk registers, track outstanding findings, and monitor risk closure
• Perform control monitoring and effectiveness reviews to validate compliance with internal policies, ISO 27001, and regulatory obligations (e.g., RBI compliance)
• Support internal and external audits by coordinating evidence collection, responding to auditor requests, and tracking remediation actions
• Manage customer security assessments, due diligence requests, and security questionnaire responses
• Coordinate periodic user access, privileged access, and SSO reviews
• Validate user provisioning, deprovisioning, role changes, and segregation of duties (SoD) controls
• Conduct periodic asset inventory reviews to ensure asset ownership, classification, and lifecycle compliance
• Monitor security alerts generated by SOC, SIEM, and application logs, coordinating with relevant technical teams for investigation and remediation
• Track security incidents, document findings, monitor corrective actions, and escalate critical risks
• Govern the vulnerability management process, tracking remediation timelines and reporting overdue vulnerabilities
• Conduct periodic hardening reviews of cloud, servers, endpoints, and network devices
• Perform patch compliance reviews for endpoints on a periodic basis

Requirements

• Bachelor's degree in Information Security, Computer Science, Risk Management, or a related technical field
• Approximately 5 years of dedicated experience in GRC, Information Security, Risk Management, Security Operations, IAM, and RBI compliance
• Strong knowledge of ISO 27001, ISO 22301, SOC 2, NIST CSF, and CIS frameworks