GRC Analyst

R360 Group; Bengaluru; On-site; INR 800,000 - 1,200,000; Full time

Job summary

R360 Group in Bengaluru seeks a GRC Analyst to own control implementations, evidence collection, risk registers, and audit coordination across multiple security frameworks. You will work with AppSec, DevOps, and client InfoSec teams to keep certifications current and audits pass-ready.

The role emphasizes hands-on experience with ISO 27001/27701, ISO 20000-1, SOC 2, PCI DSS, and DPDP Act 2023, plus a strong focus on documentation, governance, and clear communication with auditors and

Qualifications

• 2–3 years of hands-on GRC/compliance/IT audit experience.
• Experience in BFSI/fintech or regulated environments preferred.
• Familiarity with ISO 27001/27701, 20000-1, SOC 2, PCI DSS, and DPDP.

Responsibilities

• Own ISMS controls, SoA revision, and risk treatment evidence.
• Coordinate internal and external audits with cert bodies.
• Maintain PIMS, ROPA, and DPDP obligations.
• Manage ITSM processes aligned to ISO 20000-1.
• Coordinate SOC 2 readiness and auditor requests.
• Maintain PCI DSS AoC/RoC docs and remediation tracking.
• Maintain risk register and third‑party risk assessments.
• Draft policies, awareness programs, and change governance.
• Support RBI reporting and CERT-In timelines; dashboards for leadership.

Skills

GRC coordination

Documentation discipline

Regulatory awareness

Education

Bachelor's degree in Information Security, IT, Law, Business, or related field

Tools

ServiceNow GRC

OneTrust

Vanta

Drata

Job description

R360 (Reward360 Global Services) operates one of the denser multi-framework compliance stacks in the Indian BFSI-adjacent fintech space, maintaining concurrent conformance to ISO/IEC 27001:2022, ISO/IEC 27701, ISO/IEC 20000-1, SOC 2 (Type I/II), India's DPDP Act 2023, and PCI DSS v4.0.1 in addition to bank-specific vendor security requirements from clients including HDFC Bank, ICICI Bank, and Kotak Mahindra Bank. As GRC Analyst, you will own control implementation, evidence collection, risk register maintenance, and audit coordination across this stack, working closely with AppSec, DevOps/Infra, and client-facing InfoSec teams to keep certifications live and the organization continuously audit-ready.

Key Responsibilities

1. ISMS Ownership & Certification Maintenance (ISO/IEC 27001:2022)

• Maintain the Statement of Applicability (SoA), risk treatment plan, and control implementation evidence.
• Support internal audits, management review meetings, and surveillance/recertification audits with external certification bodies.

2. Privacy Management (ISO/IEC 27701 + DPDP Act 2023)

• Maintain the Privacy Information Management System (PIMS) extension to the ISMS.
• Maintain Records of Processing Activities (ROPA), consent-flow mapping, and data-principal-rights handling against DPDP Act 2023 obligations (consent manager touchpoints, breach notification timelines, Data Fiduciary/Processor duties).
• Support Data Protection Impact Assessments (DPIAs) for new features, products, and vendors handling personal data.

3. IT Service Management (ISO/IEC 20000-1)

• Maintain ITSM process documentation — incident, problem, change, capacity, and service level management — aligned to ISO/IEC 20000-1 requirements.
• Coordinate with DevOps/Infra on service management metrics and supporting audit evidence.

4. SOC 2 Readiness & Audit Support

• Maintain Trust Services Criteria control matrices (security, availability, confidentiality, and processing integrity /privacy where applicable).
• Coordinate auditor evidence requests across SOC 2 Type I (point-in-time) and Type II (operating effectiveness over a review period) engagements.

5. PCI DSS v4.0.1 Compliance

• Maintain Attestation of Compliance (AoC) / Report on Compliance (RoC) documentation and BAU evidence (Requirements 1–12).
• Track compensating controls, quarterly ASV scan remediation, and annual penetration test finding closurealongside the AppSec team.

6. Risk & Third-Party Risk Management

• Maintain the enterprise risk register; run risk assessments for new projects, products, and vendor/third-party integrations.
• Support responses to client-facing vendor security questionnaires from banking clients (HDFC, ICICI, Kotak, and others).

7. Policy, Awareness & Change Governance

• Draft and maintain InfoSec policies, standards, and procedures; run security awareness training and track completion metrics.
• Provide GRC input into the PCCB (internal change control gate) process for compliance-impacting changes.

8. Regulatory Reporting & Metrics

• Support RBI regulatory reporting and CERT-In incident reporting timelines where GRC input is required.
• Build and maintain compliance dashboards/KPIs for leadership and board-level reporting.

Required Qualifications

• Bachelor's degree in Information Security, IT, Law, Business, or a related field.
• 2–3 years of hands-on GRC / compliance / IT audit experience, ideally in BFSI, fintech, SaaS, or another regulated environment.
• Working knowledge of at least 2–3 of the following, with demonstrated ability to ramp on the remainder within 90 days: ISO/IEC 27001:2022, ISO/IEC 27701, ISO/IEC 20000-1, SOC 2 Trust Services Criteria, PCI DSS v4.0.1, DPDP Act 2023.
• Familiarity with GRC tooling (e.g., ServiceNow GRC, OneTrust, Vanta, Drata, or equivalent) is a plus.
• Understanding of risk assessment methodologies (qualitative and quantitative; FAIR exposure is a plus).
• Strong documentation discipline policies, SOPs, audit evidence packages that hold up under external QSA/auditor scrutiny.
• Experience directly coordinating with external auditors, QSAs, or certification bodies is a strong plus.

Preferred Certifications

• ISO/IEC 27001 Lead Implementer or Lead Auditor
• CDPSE (Certified Data Privacy Solutions Engineer)
• CIPP/E or CIPM (privacy)
• PCI DSS Internal Security Assessor (ISA)