Cybersecurity Risk & Compliance Analyst -2

Overview

Provides analytical support across cybersecurity risk management processes, including exceptions management, issues management, the cybersecurity risk register, policies and standards maintenance, and risk metrics/KPI reporting, while learning from senior team members and gaining exposure to business operations.

What you'll do

• Support the end-to-end exceptions lifecycle, including reviewing exception assessments, performing risk analysis, and coordinating with subject matter experts (SMEs) to validate risk ratings.
• Prepare exception submissions for approval and acceptance, ensuring documentation meets process and audit standards.
• Track exception status, expirations, and renewals, and follow up with control/process owners as needed.
• Maintain exceptions management tooling and templates to support consistent intake and processing.
• Process and risk-rate individual instances of non-compliance identified through audits, assessments, or self-identification.
• Work with control owners to validate issue details, root cause, and remediation plans.
• Track issues through to closure, escalating overdue or high-risk items as appropriate.
• Maintain issue management documentation and evidence files.
• Support processing and risk rating of organization-wide cybersecurity risks for inclusion in the risk register.
• Help maintain and update risk treatment plans under guidance.
• Support vendor and third-party risk management activities, including questionnaire reviews and evaluation of third-party security controls.
• Assist with cybersecurity due diligence for business initiatives and embedding requirements into business processes.
• Work with policy and standards SMEs to ensure verbiage remains accurate, current, and aligned to regulatory and organizational requirements.
• Support the annual policy review cycle, tracking review dates and coordinating updates with business units.
• Help maintain the cybersecurity policy repository with proper version control.
• Assist with development of cybersecurity awareness training materials.
• Track and compile key risk indicators (KRIs) and metrics across Risks, Issues, Exceptions, and Policies/Standards workflows.
• Support preparation of board and management-level reporting on program metrics.
• Help identify trends or gaps in metrics to support continuous improvement.

What you'll need

• Bachelor's degree in Computer Science, Information Systems, Cybersecurity, or Computer Engineering; equivalent combination of education and professional experience will be considered.
• 2-3 years of IT/cybersecurity experience with exposure to risk and compliance.
• 2-3 years contributing to multi-site or multi-country initiatives.
• Experience supporting compliance and risk management activities in IT environments.
• Exposure to internal audits of IT operations, applications, or projects.
• Basic experience with cybersecurity policy development or implementation.
• Familiarity with cybersecurity risk assessment methodologies.
• Basic understanding of compliance frameworks: ISO 27001/27002, NIST Cybersecurity Framework, SOC1/SOC2, NIST AI RMF.
• Awareness of data privacy regulations (GDPR, CCPA, etc.).
• Exposure to regulatory examinations or external audits.
• Basic understanding of business continuity principles.
• Familiarity with GRC technologies and policy management platforms.
• Basic knowledge of network security, cloud security, and application security concepts.
• Understanding of cybersecurity maturity models.
• Experience with security control documentation and testing support.
• Strong written and oral English communication skills.
• Good technical writing skills for documentation.
• Ability to explain technical concepts to business audiences.
• Strong analytical and problem-solving abilities.
• Good research skills and attention to detail.
• Ability to support risk assessments and document findings.
• Proactive approach to identifying issues.
• Quality-focused with flexibility and adaptability.
• Ability to prioritize tasks effectively.
• Team player with collaborative approach.
• Eager to learn and develop professionally.

Nice to have

• Exposure to corporate environments (financial services, telecommunications, utilities).
• Real estate services industry awareness.
• Multi-jurisdictional compliance exposure.
• Exposure to GRC technologies and policy management platforms (ServiceNow GRC, Archer, MetricStream).
• Knowledge of network security, cloud security, application security, and penetration testing concepts.
• Understanding of threat intelligence and its application to risk assessments.
• Familiarity with cybersecurity metrics and reporting.
• Familiarity with cybersecurity maturity models (C2M2, NIST CSF, etc.).
• Experience with security control testing and validation techniques.
• Working toward relevant certifications (CISA, CISM, CRISC).
• ITIL Foundation or similar process certifications.

Details

• On-site, Bengaluru, KA.
• Scheduled weekly hours: 40.