Jr. GRC Engineer

Neurealm Company; Chennai, Tiruchirappalli, Coimbatore District, Bengaluru, Hyderabad; On-site; INR 800,000 - 1,500,000; Full time

Job summary

Neurealm Company in Chennai, India seeks a seasoned Jr. GRC Engineer to manage third-party risk programs across the vendor lifecycle.

The role emphasizes assessing cybersecurity, privacy, regulatory compliance, and business continuity in collaboration with Legal, Procurement, and IT Security teams. The candidate should bring 2–4 years’ experience in vendor risk, strong risk assessment skills, and familiarity with GRC frameworks.

Qualifications

• 2–4 years of experience in Third-Party Risk Management.
• Experience in vendor due diligence and risk assessments.
• Knowledge of ISO 27001, NIST, or SOC 2 is beneficial.
• Experience interfacing with senior stakeholders and cross-functional teams.

Responsibilities

• Lead end-to-end Third-Party Risk Management activities across the vendor lifecycle.
• Review vendor security documentation including SOC 1/SOC 2, ISO 27001, and security questionnaires.
• Identify, communicate, and mitigate vendor risks with remediation tracking.
• Produce risk reports, dashboards, and governance metrics.
• Collaborate with Procurement, Legal, and IT Security to onboard vendors risk-informed.

Skills

Vendor risk mgmt

Due diligence

Risk governance

SOC reports

ISO 27001

Information Security

Regulatory compliance

Stakeholder mgmt

Risk reporting

GRC familiarity

Tools

ServiceNow GRC

Archer

MetricStream

OneTrust

ProcessUnity

Job description

## Jr. GRC Engineer11-09-2026 11:35:31Job\\_3047162 - 4 years* Chennai, Tamil Nadu, India (CHN)Job SummaryWe are seeking an experienced Third-Party Risk Management (TPRM) professional with 2 to 4 years of experience in managing vendor risk programs, conducting third-party due diligence, and driving risk governance across the vendor lifecycle. The ideal candidate will have strong expertise in assessing and managing third-party risks across cybersecurity, operational resilience, privacy, compliance, and business continuity domains.The role requires close collaboration with Procurement, Legal, Information Security, Compliance, and Business teams to ensure effective risk management of vendors and external partners. Exposure to Governance, Risk & Compliance (GRC) frameworks and risk management practices is desirable.Key ResponsibilitiesThird-Party Risk Management (Primary Focus)Lead end-to-end Third-Party Risk Management activities across the vendor lifecycle.Conduct inherent risk assessments and due diligence reviews for new and existing vendors.Evaluate vendor controls related to Information Security, Cybersecurity, Data Privacy, Business Continuity, Regulatory Compliance, and Operational Risk.Review and assess vendor security documentation, including SOC 1/SOC 2 reports, ISO 27001 certifications, penetration testing reports, and security questionnaires.Identify, document, and communicate vendor risks and recommended mitigation strategies.Track remediation plans and ensure timely closure of identified control gaps.Drive periodic vendor reassessments and continuous monitoring activities.Support contract reviews by identifying and recommending risk and compliance requirements.Develop and maintain TPRM policies, standards, procedures, and risk assessment methodologies.Produce risk reports, dashboards, and metrics for management and governance forums.Partner with internal stakeholders to ensure risk-informed vendor onboarding and management decisions.Governance & Risk Support (Secondary Focus)Support broader GRC initiatives, including risk assessments, policy reviews, and compliance activities.Maintain risk registers and support risk reporting processes.Assist during internal and external audits related to third-party risk controls.Contribute to the enhancement of risk governance frameworks and control environments.Required Qualifications2 - 4 years of overall experience in Third-Party Risk Management / Vendor Risk Management.Strong experience conducting vendor due diligence and risk assessments.Solid understanding of third-party risk domains including:Cybersecurity RiskInformation SecurityData PrivacyOperational RiskRegulatory & Compliance RiskExperience reviewing SOC reports, ISO certifications, security questionnaires, and audit reports.Experience interacting with senior stakeholders, vendors, and cross-functional teams.Strong risk analysis, reporting, and communication skills.Preferred QualificationsWorking knowledge of GRC frameworks and enterprise risk management practices.Familiarity with ISO 27001, NIST, SOC 2, COBIT and related control frameworks.Experience with TPRM/GRC platforms such as ServiceNow GRC, Archer, MetricStream, OneTrust, ProcessUnity or similar tools.Good to have certifications such as CRISC, CISA, CISSP, CISM, or CTPRPIdeal Candidate ProfileA seasoned TPRM professional who has led vendor risk assessments and third-party governance programs, can independently engage with senior stakeholders, and possesses sufficient GRC knowledge to align third-party risk activities with the organization's overall risk and compliance framework. This role should ideally be 70–80% TPRM-focused and 20–30% GRC-oriented.