GRC Analyst

Soffit Infrastructure Services (P) Ltd; Ernakulam; On-site; INR 800,000 - 1,200,000; Full time

Job summary

A leading infrastructure services company in Ernakulam seeks a GRC professional to help establish and improve governance frameworks and compliance programs. The role requires expertise in managing policies, conducting risk assessments, ensuring compliance with various standards, and coordinating audits. The ideal candidate should have a strong understanding of GRC frameworks, effective communication skills, and the ability to manage multiple compliance activities. This role offers the opportunity to work in a dynamic environment.

Qualifications

• Strong knowledge of ISO 27001, NIST, COBIT, ITIL frameworks.
• Experience with risk assessment methodologies.
• Knowledge of compliance requirements like GDPR.

Responsibilities

• Develop and maintain IT governance policies.
• Conduct risk assessments and document risks.
• Coordinate audits and compliance assessments.
• Provide security awareness sessions for employees.

Skills

Understanding of GRC frameworks

Strong analytical skills

Effective communication

Attention to detail

Good documentation skills

Tools

ServiceNow GRC

Archer

MetricStream

Job description

The GRC professional will support the organization in establishing, maintaining, and improving governance frameworks, risk management processes, and compliance programs. The role involves policy management, risk assessments, audits, regulatory compliance, and coordination with internal and external stakeholders.

Key Responsibilities

Governance

• Develop, review, and maintain information security and IT governance policies, standards, procedures, and guidelines
• Ensure alignment of policies with business objectives and regulatory requirements
• Support corporate governance initiatives and internal control frameworks
• Conduct IT and information security risk assessments and document risk registers
• Identify, analyze, and evaluate operational, IT, and compliance risks
• Support risk treatment plans and track remediation activities
• Assist in Business Impact Analysis (BIA) and risk reporting to management

Compliance

• Ensure compliance with standards and regulations such as:
• ISO 27001 / ISO 27701
• SOC 1 / SOC 2
• GDPR / DPDP Act (India)
• PCI-DSS (if applicable)
• Coordinate internal and external audits and compliance assessments
• Track compliance gaps and follow up on corrective actions

Audit & Assessments

• Plan and execute internal audits and control assessments
• Support third-party/vendor risk assessments
• Collect audit evidence and maintain compliance documentation
• Respond to audit queries and ensure timely closure of observations

Awareness & Reporting

• Conduct security and compliance awareness sessions for employees
• Prepare dashboards, metrics, and compliance reports for management
• Maintain GRC documentation and compliance trackers

Technical Skills

• Strong understanding of GRC frameworks (ISO 27001, NIST, COBIT, ITIL)
• Experience with risk assessment methodologies
• Knowledge of regulatory and legal compliance requirements
• Familiarity with GRC tools (ServiceNow GRC, Archer, MetricStream – preferred)

Soft Skills

• Strong analytical and problem-solving skills
• Good documentation and reporting skills
• Effective communication with cross-functional teams
• Attention to detail and ability to manage multiple compliance activities

Certifications (Preferred)