GRC Analyst II

Overview

Support Rackspace's Managed Cloud Security Posture Management (CSPM) services as a GRC Analyst II, independently managing day-to-day governance, risk and compliance activities and providing risk-based recommendations to the internal team and occasionally to customers.

What you'll do

• Conduct security risk assessments, control reviews and compliance gap analyses; translate findings into business risk and prioritized recommendations.
• Maintain customer risk registers, control matrices, treatment plans, policy exceptions and risk-acceptance records, including approvals and expiry dates.
• Map and assess controls against frameworks such as ISO 27001, NIST CSF / 800-53, CIS Controls, SOC 2 and PCI DSS, as applicable to customer scope.
• Coordinate remediation governance with cloud, CSPM, VMDR, SOC and infrastructure SMEs; track ownership, evidence, overdue actions and escalation through closure.
• Prepare customer-facing risk, compliance and posture reports; lead routine GRC reviews and explain material risks to technical and nontechnical stakeholders.
• Support audit readiness through evidence collection, control documentation, findings tracking and coordination with customer or internal auditors.
• Improve standardized GRC reporting, assessment checklists, risk-scoring methods and service delivery procedures.

What you'll need

• Approximately 5+ years in information security GRC, risk management, compliance or control assurance roles.
• Practical experience with risk assessments, compliance mapping, audit evidence, risk registers and remediation follow-up.
• Working knowledge of ISO 27001, NIST CSF, NIST 800-53, CIS Controls, SOC 2 and PCI DSS; ability to interpret controls in customer environments.
• Ability to understand security findings from CSPM, vulnerability management and SOC teams and assess their risk and compliance implications without administering those platforms.
• Strong analytical, written communication, customer presentation, stakeholder coordination and independent delivery skills.
• Self-motivated, proactive and customer-focused; ability to prioritize multiple incidents in a fast-paced operational environment.
• Willingness to work flexible schedules and support critical customer situations.

Nice to have

• Experience in an MSSP or customer-facing managed security environment.
• Familiarity with cloud security and CSPM reporting tools (including Prowler).
• Desired certifications: CRISC, CISA, CISM, ISO 27001 Lead Auditor / Lead Implementer or equivalent.

Details

• Location: Gurgaon, India.
• Flexible schedules required to support critical customer situations.