GRC Analyst

Reward360; Bengaluru; On-site; INR 700,000 - 1,100,000; Full time

Job summary

Reward360 is seeking a GRC Analyst in Bengaluru to own control implementation, evidence collection, risk register maintenance, and audit coordination across ISMS, PIMS, and ITSM processes. You will collaborate with AppSec, DevOps/Infra, and client teams to keep certifications current and audits ready.

The role requires 2–3 years of hands-on GRC/compliance/IT audit experience, plus working knowledge of ISO/IEC standards, SOC 2, PCI DSS, and the DPDP Act 2023. Familiarity with GRC tools is a plus.

Qualifications

• 2–3 years hands-on GRC/compliance/IT audit experience, ideally in BFSI/fintech/SaaS.
• Working knowledge of ISO/IEC 27001:2022, ISO/IEC 27701, ISO/IEC 20000-1, SOC 2, PCI DSS v4.0.1, DPDP Act 2023.
• Familiarity with GRC tooling (e.g., ServiceNow GRC, OneTrust, Vanta, Drata).
• Understanding of qualitative/quantitative risk assessment methods.

Responsibilities

• Own ISMS maintenance, SoA updates, and risk treatment evidence.
• Coordinate with internal teams and external auditors for certifications.
• Maintain PIMS extension, ROPA, consent flows, and DPDP obligations.
• Maintain ITSM process docs and align with ISO/IEC 20000-1.
• Coordinate SOC 2 readiness and auditor evidence.
• Track PCI DSS AoC/RoC and remediation efforts.
• Maintain enterprise risk register and conduct risk assessments.
• Draft and maintain InfoSec policies, standards, and training.
• Support RBI reporting and governance dashboards.

Skills

GRC experience

IT audit

Regulatory frameworks

Documentation discipline

Education

Bachelor's degree in Information Security, IT, Law, Business

Tools

ServiceNow GRC

OneTrust

Vanta

Drata

Job description

About the Role

R360 (Reward360 Global Services) operates one of the denser multi-framework compliance stacks in the Indian BFSI-adjacent fintech space, maintaining concurrent conformance to ISO/IEC 27001:2022, ISO/IEC 27701, ISO/IEC 20000-1, SOC 2 (Type I/II), Indias DPDP Act 2023, and PCI DSS v4.0.1 in addition to bank-specific vendor security requirements from clients including HDFC Bank, ICICI Bank, and Kotak Mahindra Bank. As GRC Analyst, you will own control implementation, evidence collection, risk register maintenance, and audit coordination across this stack, working closely with AppSec, DevOps/Infra, and client-facing InfoSec teams to keep certifications live and the organization continuously audit-ready.

Key Responsibilities

1. ISMS Ownership & Certification Maintenance (ISO/IEC 27001:2022)

• Maintain the Statement of Applicability (SoA), risk treatment plan, and control implementation evidence.
• Support internal audits, management review meetings, and surveillance/recertification audits with external certification bodies.

2. Privacy Management (ISO/IEC 27701 + DPDP Act 2023)

• Maintain the Privacy Information Management System (PIMS) extension to the ISMS.
• Maintain Records of Processing Activities (ROPA), consent-flow mapping, and data-principal-rights handling against DPDP Act 2023 obligations (consent manager touchpoints, breach notification timelines, Data Fiduciary/Processor duties).
• Support Data Protection Impact Assessments (DPIAs) for new features, products, and vendors handling personal data.

3. IT Service Management (ISO/IEC 20000-1)

• Maintain ITSM process documentation - incident, problem, change, capacity, and service level management - aligned to ISO/IEC 20000-1 requirements.
• Coordinate with DevOps/Infra on service management metrics and supporting audit evidence.

4. SOC 2 Readiness & Audit Support

• Maintain Trust Services Criteria control matrices (security, availability, confidentiality, and processing integrity /privacy where applicable).
• Coordinate auditor evidence requests across SOC 2 Type I (point-in-time) and Type II (operating effectiveness over a review period) engagements.

5. PCI DSS v4.0.1 Compliance

• Maintain Attestation of Compliance (AoC) / Report on Compliance (RoC) documentation and BAU evidence (Requirements 1-12).
• Track compensating controls, quarterly ASV scan remediation, and annual penetration test finding closurealongside the AppSec team.

6. Risk & Third-Party Risk Management

• Maintain the enterprise risk register; run risk assessments for new projects, products, and vendor/third-party integrations.
• Support responses to client-facing vendor security questionnaires from banking clients (HDFC, ICICI, Kotak, and others).

7. Policy, Awareness & Change Governance

• Draft and maintain InfoSec policies, standards, and procedures; run security awareness training and track completion metrics.
• Provide GRC input into the PCCB (internal change control gate) process for compliance-impacting changes.

8. Regulatory Reporting & Metrics

• Support RBI regulatory reporting and CERT-In incident reporting timelines where GRC input is required.
• Build and maintain compliance dashboards/KPIs for leadership and board-level reporting.

Required Qualifications

• Bachelors degree in Information Security, IT, Law, Business, or a related field.
• 2-3 years of hands-on GRC / compliance / IT audit experience, ideally in BFSI, fintech, SaaS, or another regulated environment.
• Working knowledge of at least 2-3 of the following, with demonstrated ability to ramp on the remainder within 90 days: ISO/IEC 27001:2022, ISO/IEC 27701, ISO/IEC 20000-1, SOC 2 Trust Services Criteria, PCI DSS v4.0.1, DPDP Act 2023.
• Familiarity with GRC tooling (e.g., ServiceNow GRC, OneTrust, Vanta, Drata, or equivalent) is a plus.
• Understanding of risk assessment methodologies (qualitative and quantitative; FAIR exposure is a plus).
• Strong documentation discipline policies, SOPs, audit evidence packages that hold up under external QSA/auditor scrutiny.
• Experience directly coordinating with external auditors, QSAs, or certification bodies is a strong plus.

Preferred Certifications

• ISO/IEC 27001 Lead Implementer or Lead Auditor
• CDPSE (Certified Data Privacy Solutions Engineer)
• ISO/IEC 27701 Lead Implementer
• CIPP/E or CIPM (privacy)
• PCI DSS Internal Security Assessor (ISA)

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.