GRC Cyber Specialist

Acquisory Consulting LLP; Greater Noida; Hybrid; INR 1,200,000 - 1,800,000; Full time

Job summary

Acquisory Consulting LLP seeks a GRC Cybersecurity Specialist to deliver client engagements spanning cybersecurity audits, IT governance, technology risk, regulatory compliance, information security management, and data privacy.

The role requires practical experience in assessing security controls, identifying gaps, supporting framework implementation, and preparing clear, actionable reports across client business, IT, risk, and compliance teams.

Qualifications

• Bachelor’s degree in IT, CS, Information Security or related field.
• Certifications such as CISA, CISM, CISSP or ISO/IEC 27001 Lead Auditor preferred.

Responsibilities

• Lead cybersecurity audits, ITGC/ITAC reviews and risk assessments.
• Support ISO 27001 implementation, gap analyses, and ISMS improvements.
• Conduct regulatory assessments against RBI/SEBI/IRDAI where applicable.
• Assist DPDP/GDPR readiness assessments and privacy reviews.
• Map controls to NIST, CIS, ISO/IEC 27001 and ISO/IEC 27701.
• Prepare findings with business impact and remediation plans.
• Coordinate with client teams and present findings to management.
• Manage engagements and mentor junior team members.

Skills

GRC cybersecurity

IT audits

Regulatory compliance

ISO/IEC 27001

Data privacy

Risk assessment

Stakeholder management

Client communication

Team handling

Education

Bachelor’s degree in IT / CS / InfoSec

CISA or CISSP or CISM (preferred)

Lead Auditor/Lead Implementer (preferred)

Job description

GRC Cybersecurity Specialist – Consulting

Experience: Above 5 years of experience

Location: Delhi NCR

Employment type: Full-time

Working arrangement: Office and client-site working, with travel as required for consulting engagements (Global & India)

Role Description

We are hiring a GRC Cybersecurity Specialist to deliver client engagements across cybersecurity audits, IT governance, technology risk, regulatory compliance, information security management, and data privacy.

The role requires practical experience in assessing security controls, identifying gaps, supporting framework implementation, and preparing clear, actionable reports. The specialist will work closely with client business, IT, information security, risk, and compliance teams, managing assigned workstreams from planning and assessment through reporting and remediation follow-up.

Key Responsibilities

• Cybersecurity and IT audits: Conduct cybersecurity audits, IT General Controls (ITGC) reviews, IT Application Controls (ITAC) assessments, and technology risk assessments. Evaluate access management, change management, IT operations, infrastructure security, cloud security, third-party security, and business continuity controls.
• ISO audits and implementation: Support ISO/IEC 27001 implementation, gap assessments, risk assessments, internal audits, certification readiness, and ongoing Information Security Management System (ISMS) improvement. Develop policies, procedures, risk treatment plans, Statements of Applicability, and supporting evidence.
• Regulatory assessments: Conduct or support regulatory cybersecurity and IT compliance reviews against applicable RBI, SEBI, IRDAI, CERT-In, and other sector-specific requirements, based on the client’s industry and engagement scope.
• Data privacy: Support DPDP and GDPR readiness assessments and implementation activities, including personal data inventories, data flow mapping, privacy notices, consent processes, retention practices, data principal/data subject rights workflows, and third-party privacy reviews.
• Framework assessments: Assess and map controls against relevant global frameworks and standards, including NIST CSF, NIST SP 800-53, CIS Controls, ISO/IEC 27001, and ISO/IEC 27701.
• Control testing and evidence review: Conduct stakeholder interviews, walkthroughs, sample-based testing, and reviews of policies, system configurations, access records, logs, and other audit evidence.
• Reporting and remediation: Prepare risk-rated findings, explain business impact, recommend practical corrective actions, and track remediation through evidence-based closure.
• Client delivery: Lead assigned client discussions, coordinate evidence requests, communicate progress and dependencies, and present findings to technical teams and management.
• Consulting support: Contribute to proposals, scope documents, assessment checklists, presentations, and internal knowledge development.
• Small Team Handling: Able to assign & handle team of cyber folks for engagements

Required Skills and Experience

• Approximately 5 years of relevant experience in cybersecurity GRC, IT audit, information security consulting, technology risk, or regulatory compliance.
• Practical experience delivering cybersecurity audits and ISO/IEC 27001 audit or implementation engagements.
• Exposure to regulatory audits or compliance assessments involving RBI, SEBI, and/or IRDAI requirements.
• Working knowledge of India’s DPDP framework, GDPR, and global information security frameworks.
• Ability to assess technical controls across applications, databases, operating systems, networks, cloud environments, and security tools.
• Experience in risk assessment, control testing, audit documentation, policy development, and remediation tracking.
• Strong report-writing, presentation, stakeholder management, and client communication skills.
• Ability to manage multiple assignments, meet deadlines, and work from both office and client locations.

Qualifications and Preferred Credentials

• Bachelor’s degree in Information Technology, Computer Science, Information Security, Engineering, or a related discipline.
• Relevant certifications such as CISA, CIPP, CISM, CRISC, CISSP, ISO/IEC 27001 Lead Auditor, or Lead Implementer are preferred.
• Prior consulting experience and exposure to banking, NBFCs, insurance, securities markets, or other regulated industries will be an advantage