Cyber Security GRC | Vendor Risk Assessment

Cerebra; Gurugram District; On-site; INR 1,200,000 - 1,800,000; Full time

Job summary

Cerebra in Gurgaon seeks an experienced Cyber Security GRC professional with strong enterprise risk management, cybersecurity frameworks, governance, and vendor risk assessment expertise. This role supports second-line-of-defence oversight and executive risk reporting.

Primary focus includes translating technical cybersecurity risks into business impact, embedding risk methodologies, and driving governance forums to improve risk culture and processes.

Qualifications

• Experience in enterprise risk management and cybersecurity frameworks.
• Ability to govern and oversee vendor risk assessment.
• Second-line-of-defence oversight experience.

Responsibilities

• Apply enterprise and cyber risk management frameworks across governance and risk activities.
• Review and challenge first-line risk assessments and validate data quality.
• Prepare executive-ready risk summaries, dashboards, heatmaps, and trend reports.
• Develop and maintain KRIs and KCIs, with clear thresholds and ownership.
• Establish governance forums and drive continuous risk culture improvements.

Skills

Cybersecurity risk management

GRC

Executive communication

Tools

NIST RMF

ISO 27005

ISO 31000

ISO 21434

Job description

Immediate /Short Notice Only - Cerebra Payroll - MNC Client

[e-mail]
Only Whatsapp: [phone]

Cyber Security GRC | Vendor Risk Assessment

Location: Gurgaon
Experience: 912 Years

Role Overview

We are looking for an experienced Cyber Security GRC / Cyber Risk professional with strong expertise in enterprise risk management, cybersecurity frameworks, governance, vendor risk assessment, and second-line-of-defence oversight.

Key Responsibilities

Cyber Risk Framework & Assessment

• Apply enterprise and cyber risk management frameworks across governance and risk activities.
• Work extensively with:
• NIST RMF
• ISO 27005
• ISO 31000
• ISO 21434
• Embed risk frameworks into organisational risk methodologies and assessments.
• Identify gaps and inefficiencies in existing risk management practices.
• Recommend improvements to risk processes, templates, and methodologies.

Second Line of Defence

• Review and challenge first-line risk assessments.
• Assess control effectiveness ratings, KRI breaches, remediation plans, and risk submissions.
• Validate the quality of risk and control data.
• Translate technical cybersecurity risks into business impact.

Risk Reporting & Executive Communication

• Prepare executive-ready risk summaries and decision-support briefs.
• Develop risk dashboards, heatmaps, and trend reports.
• Provide impact analysis and quantified risk exposure.
• Highlight risk-to-business implications for senior management.

KRI / KCI Management

• Track and report KPIs falling outside SLA.
• Develop and maintain Key Risk Indicators (KRIs) and Key Control Indicators (KCIs).
• Define thresholds, ownership, and measurement criteria.
• Monitor risk trends, escalations, and deviations.

Governance

• Establish and manage governance forums end-to-end.
• Prepare agendas and facilitate governance meetings.
• Document minutes and track actions through closure.
• Drive continuous improvement and risk culture reinforcement.