Consultant - GRC ( Governance Risk and Compliance ) - Bangalore locals

Pylon Management Consulting; Bengaluru; Hybrid; INR 900,000 - 1,300,000; Full time

Job summary

Pylon Management Consulting Pvt. Ltd. Bengaluru seeks a GRC specialist to bolster governance, risk, and compliance programs across ISO 27001, SOC 2, and other frameworks. You will help maintain policy libraries, support audits, and coordinate documentation with global teams.

Ideal candidates have 5 years in GRC, strong communication, and hands-on experience with Jira/Confluence and reporting tools to track KRIs and dashboards. Collaboration across time zones is essential.

Qualifications

• Bachelor's degree in information security, CS, risk management or related field.
• Around 5 years of experience in GRC, IT audit, cybersecurity compliance, or risk management.
• Familiarity with ISO/IEC 27001, NIST CSF, SOC 2, GDPR, PCI-DSS frameworks.
• Experience supporting audits or control testing activities.
• Strong documentation and coordination skills.
• Proficiency with Jira, Confluence, MS Teams/SharePoint, Excel, PowerPoint.
• Excellent written and verbal English communication; ability to work with global stakeholders.
• Exposure to vendor risk management processes or tools; ISO 27001 / SOC 2 readiness.
• Certifications like ISO 27001 Lead Implementer, CISA, CRISC, CGRC are a plus.
• Knowledge of security reporting or dashboards (Power BI, Tableau).

Responsibilities

• Maintain and update the security policy library using templates and version controls.
• Track ownership, reviews, and approvals of governance documents.
• Support policy change communication across IT and security teams.

Skills

GRC & risk management

Cybersecurity compliance

Documentation & coordination

Stakeholder communication

Jira & Confluence

Power BI / Tableau awareness

Audit readiness support

Global collaboration

Education

Bachelor's degree in information security / CS

Certifications: ISO 27001 Lead Implementer, CISA, CRISC, CGRC

Tools

Jira

Confluence

MS Teams/SharePoint

Excel

Power BI / Tableau

Job description

Core Responsibilities

Governance & Policy Management

• Maintain and update the security policy library using standardized templates and version controls.
• Track ownership, reviews, and approvals of security governance documents.
• Support communication and awareness of policy changes across IT and security teams.

Risk & Compliance Management

• Assist in maintaining the enterprise cybersecurity risk register, ensuring risks are properlydocumented, assessed, and tracked to remediation.
• Help monitor compliance with security frameworks (ISO 27001, SOC 2, NIST CSF, PCI-DSS, GDPR, PIPEDA).
• Prepare and manage documentation and evidence for internal and external audits.
• Support global readiness efforts for certifications such as ISO 27001 and SOC 2.

Vendor Risk Management

• Conduct vendor security due diligence and assessments based on tiering criteria(criticality, data access, geography).
• Validate vendor certifications (SOC 2, ISO 27001, PCI, etc.) and monitor reassessment schedules.
• Document findings, exceptions, and risk mitigations in Jira or other approved tools.

Exception & Risk Acceptance Tracking

• Manage intake, approval, and expiry tracking for policy exceptions and risk acceptances.
• Ensure each exception has clear justification, defined expiration, and mitigation plan..

Metrics & Reporting

• Support development of dashboards and reports tracking Key Risk Indicators (KRIs),policy reviews, vendor status, and audit results.
• Assist in preparing quarterly GRC summary reports for senior management.

Required Qualifications

• Bachelors degree in information security, Computer Science, Risk Management, or a related discipline.
• About 5 years of experience in GRC, IT audit, cybersecurity compliance, or risk management.
• Familiarity with major frameworks: ISO/IEC 27001, NIST CSF, SOC 2, GDPR, PCI-DSS.
• Experience supporting audits or control testing activities.
• Strong documentation and coordination skills.
• Proficiency with collaboration and workflow tools (e.g., Jira, Confluence, Microsoft Teams/SharePoint, Excel, PowerPoint).
• Excellent written and verbal English communication skills (role supports global stakeholders).
• Ability to work independently with global teams across multiple time zones.
• Experience supporting ISO 27001 certification or SOC 2 readiness.
• Prior exposure to vendor risk management processes or tools.
• Certifications such as ISO 27001 Lead Implementer, CISA, CRISC, or CGRC (CAP).
• Knowledge of security reporting or dashboarding (Power BI, Tableau, or similar).