Cyber Risk & Compliance Analyst

Overview

The Senior IT Compliance Specialist is a hands-on, globally oriented role responsible for translating regulatory, customer, and internal security requirements into sustainable controls, defensible evidence, and audit-ready operations.

What you'll do

• Lead and manage IT compliance initiatives to ensure adherence to internal policies, standards, contractual obligations, and applicable international or government security frameworks.
• Own assigned workstreams from requirement intake and scoping through control mapping, gap assessment, remediation, evidence readiness, and ongoing governance.
• Maintain compliance strategies, roadmaps, and operating plans that align security requirements with business priorities, technology architecture, and delivery commitments.
• Establish clear accountability with business owners, IT asset owners, and control owners; track decisions, risks, dependencies, and remediation commitments to closure.
• Drive certification and assurance efforts by coordinating internal audits, external assessments, customer reviews, risk assessments, and security documentation submissions.
• Plan and facilitate readiness activities for ISO 27001, NIST SP 800-171, CMMC, TISAX, NIS2, and other requirements assigned to the team.
• Coordinate requests with assessors and third-party auditors, validate the completeness and quality of evidence, and ensure responses are accurate, consistent, and traceable.
• Manage findings and corrective actions using a risk-based approach, including root-cause analysis, remediation planning, validation, exception handling, and status reporting.
• Promote continuous readiness by defining evidence expectations, review cadences, health indicators, and escalation paths rather than relying on point-in-time audit preparation.
• Interpret framework and regulatory requirements and translate them into clear, testable control objectives, control activities, evidence requirements, and ownership models.
• Partner with engineering, infrastructure, application, cloud, security operations, identity, data, and support teams to embed controls into technology processes and system lifecycles.
• Assess control design and operating effectiveness, identify gaps or duplicated effort, and recommend practical remediation that balances risk, compliance, and operational needs.
• Support continuous monitoring through defined metrics, automated evidence collection, exception reporting, and periodic control reviews.
• Contribute to reusable control mappings and a unified control approach to reduce duplication across overlapping frameworks and customer obligations.
• Maintain and enhance System Security Plans (SSPs), Information Security Management System, policies, standards, procedures, control narratives, risk assessments, plans of action, evidence repositories, and governance records.
• Serve as a subject matter expert on IT compliance, advising internal teams on scope, control expectations, audit evidence, risk treatment, and compliance-by-design.
• Support customers, contracting stakeholders, and Authorizing Officials (AOs) by providing approved compliance documentation and clear guidance for security evaluations.
• Prepare concise status reports, risk statements, decision materials, and executive updates that distinguish confirmed facts, open issues, ownership, and required action.
• Develop practical guidance and targeted training for control owners and technical teams to improve execution quality and audit readiness.
• Coordinate with Legal, Privacy, Procurement, Internal Audit, Security, and business stakeholders to validate interpretations and convert changes into actionable implementation plans.
• Identify opportunities to automate recurring compliance activities, streamline evidence collection, improve workflow quality, and reduce manual or duplicative work.
• Use lessons learned, audit results, metrics, and stakeholder feedback to improve control design, documentation quality, governance, and team operating practices.
• Perform other responsibilities or special assignments as requested by leadership.

What you'll need

• 5–10 years of relevant experience in IT compliance, IT audit, cybersecurity governance, technology risk, or a closely related discipline.
• Demonstrated experience leading compliance assessments, audits, certifications, or regulatory readiness efforts in a complex, multinational technology environment.
• Working knowledge of several of the following: ISO 27001/27002, NIST SP 800-171, CMMC, TISAX, NIS2, NIST Cybersecurity Framework, SOC reporting, IT general controls, or comparable security frameworks.
• Experience translating requirements into control designs, test procedures, evidence expectations, risk statements, and remediation plans.
• Experience creating or maintaining compliance documentation such as SSPs, policies, standards, procedures, control narratives, risk assessments, and audit evidence packages.
• Ability to manage multiple workstreams, organize complex information, meet deadlines, and escalate material risks or dependencies with sound judgment.
• Strong written and verbal English communication skills, including the ability to work effectively across cultures, functions, technical disciplines, and time zones.
• Bachelor’s degree in information systems, cybersecurity, computer science, accounting, risk management, business, or a related field, or equivalent relevant experience.

Nice to have

• Relevant certification such as CISA, CRISC, CISSP, ISO 27001 Lead Implementer or Lead Auditor, CISM, or a comparable credential.
• Experience supporting cloud or hybrid environments, regulated data, government contracting obligations, automotive assurance, or European cybersecurity requirements.
• Experience with governance, risk, and compliance platforms; workflow automation; data visualization; scripting; or automated evidence collection.
• Familiarity with third-party risk, privacy, Responsible AI governance, mergers and acquisitions, or customer security assurance.
• Experience supporting distributed teams through clear documentation, structured handoffs, measurable service expectations, and overlapping working hours when required.

Details

• Location: Hyderabad, Telangana.
• Global collaboration across time zones; occasional schedule flexibility may be required for audits, customer discussions, incidents, or regulatory deadlines.