Cyber Security GRC Consultant @ Mumbai

Quess IT Solutions; Mumbai; On-site; INR 1,600,000 - 2,800,000; Full time

Job summary

Quess IT Solutions is hiring a Cybersecurity GRC Consultant with 5–6 years of relevant experience to support consulting, assessment, audit, and compliance engagements across information security, privacy, and regulatory requirements.

The role involves designing governance, risk, and compliance programs, policy development, and client-ready reports for BFSI and other sectors. Strong communication and stakeholder management are essential for success.

Qualifications

• 5–6 years of relevant experience in cybersecurity GRC consulting, information security consulting, IT audit, risk advisory, compliance, or related roles.
• Hands-on experience in ISO/IEC 27001 implementation, gap assessment, internal audit, risk assessment, control documentation, or certification-readiness engagements.
• Strong ability to translate regulatory requirements into practical client controls.
• Experience with RBI, SEBI, IRDAI cybersecurity expectations; BFSI exposure preferred.
• Demonstrated client-facing report writing, audits, and remediation planning.

Responsibilities

• Conduct cybersecurity GRC consulting, assessment, audit, and advisory engagements for client organizations.
• Perform ISO/IEC 27001:2022 ISMS gap assessments, internal audits, implementation support, risk assessments, control reviews, and certification-readiness activities.
• Support BCMS and ISO 22301-related continuity, impact analysis, and exercise planning.
• Lead or support SOC 2 Type II readiness reviews, control design assessments, and evidence reviews.
• Develop, review, and enhance policies, standards, and risk registers; prepare client deliverables.

Skills

Cybersecurity GRC

Client management

ISO/IEC 27001

NIST framework

Regulatory compliance

Policy development

Audit readiness

Third-Party Risk Mgmt

SOC 2 Type II

Data privacy

Risk assessments

Reporting

Microsoft Word

Excel

PowerPoint

Tools

Microsoft Word

Excel

PowerPoint

Job description

Job Description: Cybersecurity GRC Consultant

Experience: 5–6 years of relevant cybersecurity consulting and audit experience

Employment Type: Full-time

We are seeking a knowledgeable and client-focused Cybersecurity GRC Consultant to support consulting, assessment, audit, compliance, and documentation engagements across information security, privacy, regulatory compliance, third-party risk, and cyber resilience. The ideal candidate will have hands‑on experience delivering cybersecurity GRC engagements for clients, interpreting regulatory requirements, conducting maturity and posture assessments, and preparing high-quality client‑facing reports, policies, and remediation roadmaps.

Role Overview

The Cybersecurity GRC Consultant will work with clients across industries to assess, design, implement, and improve cybersecurity governance, risk, compliance, privacy, and resilience programs. The role requires strong consulting capability, audit experience, stakeholder management skills, and the ability to translate technical and regulatory requirements into actionable business controls.

The consultant will contribute to engagements involving ISO standards, NIST‑based assessments, Indian financial‑sector regulations, privacy compliance, third‑party risk management, cyber risk assessment, policy development, awareness programs, and audit readiness.

Key Responsibilities

• Conduct cybersecurity GRC consulting, assessment, audit, and advisory engagements for client organizations.
• Perform ISO/IEC 27001:2022 ISMS gap assessments, internal audits, implementation support, risk assessments, control reviews, and certification‑readiness activities.
• Support business continuity and resilience engagements aligned with ISO 22301, including BCMS documentation, business impact analysis, risk assessment, continuity planning, and exercise support.
• Conduct cybersecurity posture assessments, maturity assessments, control effectiveness reviews, and compliance gap assessments.
• Assess client environments against relevant frameworks and standards, including:
• ISO/IEC 27001:2022
• NIST Cybersecurity Framework and related NIST guidance
• SOC 2 Type II requirements
• Data Protection and Digital Personal Data Protection Act, 2023 (DPDPA) requirements
• General Data Protection Regulation (GDPR)
• Data privacy principles, privacy governance, and privacy‑by‑design requirements
• RBI cybersecurity, IT governance, outsourcing, digital‑payment, and related regulatory requirements
• SEBI cybersecurity and cyber‑resilience requirements
• IRDAI cybersecurity, information security, and related regulatory requirements
• Lead or support cyber risk management activities, including risk identification, control mapping, risk scoring, treatment planning, risk‑register maintenance, and management reporting.
• Conduct Third‑Party Risk Management (TPRM) assessments, including vendor due diligence, cybersecurity questionnaires, risk evaluation, contractual security requirements, and remediation tracking.
• Support SOC 2 Type II readiness reviews, control design assessments, evidence reviews, and ongoing compliance monitoring.
• Develop, review, and enhance cybersecurity policies, standards, procedures, guidelines, frameworks, registers, and process documentation.
• Prepare client deliverables such as assessment reports, audit reports, gap‑analysis reports, compliance matrices, risk registers, remediation roadmaps, executive presentations, and management dashboards.
• Conduct cybersecurity awareness and training programs for employees, management, and relevant stakeholders.
• Facilitate client workshops, interviews, walkthroughs, evidence reviews, risk discussions, and leadership presentations.
• Track observations, nonconformities, risks, action plans, and closure evidence through the engagement lifecycle.
• Collaborate with technical, legal, privacy, business, audit, and compliance stakeholders to ensure practical implementation of cybersecurity controls.
• Keep abreast of evolving cybersecurity regulations, privacy requirements, threat trends, and industry best practices.
• Contribute to proposal development, scoping, pre‑sales discussions, statements of work, and client presentations where required.

Required Experience and Skills

• 5–6 years of relevant experience in cybersecurity GRC consulting, information security consulting, IT audit, risk advisory, compliance, or related roles.
• Demonstrated experience working directly with clients in a consulting, advisory, audit, or assurance capacity.
• Hands‑on experience in ISO/IEC 27001 implementation, gap assessment, internal audit, risk assessment, control documentation, or certification‑readiness engagements.
• Strong understanding of NIST cybersecurity frameworks and their practical application in assessment and improvement programs.
• Working knowledge of DPDPA, GDPR, data privacy governance, data lifecycle controls, consent management concepts, data‑subject rights, and privacy risk assessments.
• Experience with RBI, SEBI, and IRDAI cybersecurity and regulatory expectations; experience supporting BFSI clients will be preferred.
• Experience in Third‑Party Risk Management, including vendor security assessments, supplier due diligence, risk classification, and remediation follow‑up.
• Experience in cybersecurity posture assessments, cyber maturity assessments, cyber risk assessments, and compliance gap assessments.
• Familiarity with SOC 2 Type II requirements, Trust Services Criteria, control mapping, audit evidence, and readiness activities.
• Strong capability in developing and reviewing cybersecurity policies, standards, procedures, risk registers, control matrices, and compliance documentation.
• Experience in conducting cybersecurity training and awareness initiatives.
• Ability to interpret regulatory and framework requirements and translate them into practical, measurable, client‑specific controls.
• Strong report‑writing, documentation, presentation, stakeholder‑management, and client communication skills.
• Ability to manage multiple concurrent engagements, meet project timelines, and work independently with limited supervision.
• Proficiency in Microsoft Word, Excel, PowerPoint, and documentation/reporting tools.

Mandatory Certifications

Candidates must hold the following valid certifications:

• Certified Information Systems Auditor (CISA)

Good-to-Have Certifications

The following certifications will be an added advantage:

• Certified Information Security Manager (CISM)
• Other relevant certifications in privacy, risk management, cloud security, SOC, or business continuity

Candidate Profile

The successful candidate will be analytical, detail‑oriented, and comfortable engaging with senior client stakeholders. They should be able to balance compliance interpretation with practical business implementation, write clear and professional client deliverables, and confidently facilitate workshops and audits.

The role is best suited to a consultant who enjoys working across varied client environments and can independently drive cybersecurity GRC engagements from assessment through remediation planning and closure.