GRC Security Analyst

Overview

Support governance, risk management, and compliance activities for information security, including policy maintenance, risk assessments, audit coordination, and client-facing GRC reporting, under the guidance of senior team members.

What you'll do

• Assist in developing, reviewing, and maintaining information security policies, standards, procedures, and guidelines in line with ISO 27001 and NIST CSF.
• Support periodic policy review cycles, keeping documentation current, version-controlled, and accessible to relevant stakeholders.
• Contribute to security awareness initiatives by preparing training materials, tracking completion rates, and maintaining records.
• Maintain governance trackers and document repositories, ensuring accuracy and completeness.
• Support preparation of governance reports, dashboards, and meeting packs for internal and client stakeholders.
• Support information security risk assessments under the guidance of senior team members, contributing to identification and evaluation of threats, vulnerabilities, and business impacts.
• Maintain and update the risk register, tracking risks through treatment to closure.
• Assist with third-party and vendor risk assessments by gathering information, reviewing responses, and documenting findings.
• Support business continuity and disaster recovery documentation, review cycles, and testing activities.
• Help prepare risk reports and escalate identified risks to senior analysts or management as appropriate.
• Support compliance activities against ISO 27001, NIST CSF, CIS Controls, PCI-DSS, GDPR, and client-specific requirements.
• Assist in planning and coordinating internal and external audits, gathering evidence, preparing documentation packages, and tracking audit findings through to remediation.
• Conduct periodic compliance checks and control walkthroughs to verify controls are in place and operating as expected.
• Maintain compliance calendars and support the team in meeting regulatory deadlines, audit schedules, and periodic review obligations.
• Track and follow up on corrective action plans arising from audit findings, ensuring timely closure and accurate records.
• Assist in periodic assessments of security controls across people, process, and technology, documenting observations, gaps, and weaknesses and supporting remediation recommendations.
• Coordinate with technical and operational teams to gather evidence of control effectiveness and maintain audit-readiness records.
• Maintain and update GRC dashboards, trackers, and metrics, ensuring data accuracy and completeness.
• Prepare routine GRC reports, meeting packs, and status updates for review before distribution to clients.
• Track and report on KPIs including policy compliance rates, open risk items, audit finding closure timelines, and training completion rates.
• Support client-facing GRC activities including governance meetings, monthly business reviews, and audit sessions under the guidance of senior team members.
• Respond to client queries on policy, compliance, and risk matters accurately and in a timely manner, escalating complex queries where appropriate.
• Maintain a professional and collaborative relationship with client security and compliance contacts.
• Identify and flag opportunities to improve GRC processes, templates, and documentation practices.
• Stay current with developments in security frameworks, regulatory requirements, and industry best practices, and share updates with the team.
• Support adoption of GRC tools and contribute to improving data quality and workflow efficiency within those platforms.

What you'll need

• 2–4 years of experience in information security with exposure to governance, risk, and/or compliance functions.
• Working knowledge of at least one or two information security frameworks such as ISO 27001, NIST CSF, CIS Controls, or PCI-DSS.
• Basic understanding of risk assessment methodologies and the ability to identify and document security risks with guidance.
• Familiarity with audit processes, including evidence gathering, control walkthroughs, and finding documentation.
• Ability to contribute to the development and review of security policies and procedures.
• Good analytical skills with attention to detail and a structured approach to documentation and tracking.
• Proficient in Microsoft Office tools (Word, Excel, PowerPoint) for report preparation, tracker maintenance, and presentation development.
• Good written and verbal communication skills with the ability to convey security and compliance information clearly.

Nice to have

• Exposure to GRC platforms or ticketing tools such as ServiceNow, RSA Archer, or equivalent.
• Experience in a managed security services or client-facing environment.
• Preferred certifications: CompTIA Security+; ISO 27001 Foundation or Internal Auditor; Certified in Risk and Information Systems Control (CRISC) at Associate level; CISM or CISSP at Foundation or Associate level; any vendor-specific GRC tool certification.

Details

• Location: Bangalore, KA, India.