Senior Information Security Risk Analyst

Overview

Fam is seeking a proactive, detail-oriented IT Risk and Third-Party Risk Management (TPRM) Specialist to execute cybersecurity risk assessments for third-party vendors, suppliers and service providers, and to run internal IT risk management processes.

What you'll do

• Execute internal IT risk assessments across IT infrastructure, cloud environments, business applications and operational workflows.
• Maintain and regularly update the enterprise IT Risk Register, tracking risk treatment plans, remediation timelines and risk acceptance approvals.
• Assess the effectiveness of internal IT controls, including access management, backup and disaster recovery, change management and data security.
• Monitor Key Risk Indicators (KRIs) and assist in preparing periodic risk reports and metrics for management and oversight committees.
• Perform end-to-end cybersecurity risk assessments for third-party vendors, suppliers and external service providers.
• Review vendor security documentation, including reports, certifications, penetration testing summaries, architecture diagrams and security policies.
• Review and evaluate vendor responses to cybersecurity questionnaires, due diligence requests and risk evaluations.
• Assign vendor risk ratings, document identified gaps, establish remediation action plans and track vendor progress on outstanding risk items.
• Work closely with Procurement, Legal and stakeholder teams during vendor onboarding, ongoing monitoring and contract reviews.
• Monitor vendor-related security incidents and advisory alerts, escalating potential issues in accordance with incident response protocols.

What you'll need

• 3 to 5 years of dedicated experience in IT risk management, cybersecurity, third-party risk management (TPRM), or information security governance.
• Strong understanding of internal IT general controls (ITGC), access control, disaster recovery, cloud security concepts and data protection principles.
• Working knowledge of industry frameworks and standards, such as RBI Framework for Outsourcing of Payment and Settlement-related Activities by PSOs, RBI MD on Cyber Resilience and Digital Payment Security Controls, ISO 27001, ISO 31000 and NIST CSF.
• Demonstrated ability to review vendor reports, security certifications, penetration test summaries and questionnaires.
• Excellent analytical, organizational and documentation skills, with the ability to communicate risk findings clearly to both technical and business stakeholders.
• Proven ability to manage multiple vendor assessments and internal risk tasks simultaneously in a fast-paced environment.

Nice to have

• Professional certifications or active progress toward certifications such as CISA, CRISC or ISO 27001 LA/LI.
• Prior experience working in financial services, technology or other regulated environments.
• Hands-on experience using GRC tools or dedicated Third-Party Risk Management platforms.
• Basic awareness of AI-enabled features in GRC or risk tools.
• Experience supporting IT disaster recovery exercises or business continuity planning.

Details

• Location: Bengaluru.