Product GRC Consultant

CyRAACS™; Bengaluru; On-site; INR 600,000 - 1,200,000; Full time

Job summary

An established industry player is seeking a skilled professional to enhance their compliance and security frameworks. In this dynamic role, you will develop and maintain control frameworks aligned with global standards while leading security certification processes. You will also conduct user testing to improve product usability and provide expert consulting support to clients. This is a fantastic opportunity to make a significant impact in a rapidly evolving field, where your expertise will help shape the future of compliance and information security. Join a forward-thinking company that values innovation and collaboration.

Qualifications

• 3-6 years experience with GRC frameworks and compliance standards.
• Proven track record in managing compliance audits and certifications.

Responsibilities

• Develop and maintain control frameworks based on global standards.
• Lead security certification processes and manage compliance audits.
• Conduct user testing and provide consulting support to clients.

Skills

GRC frameworks

Compliance audits

Information security practices

Project management

Client interaction

Education

Bachelor's degree in computer science or information science

CISSP or CISM certification

Tools

GRC software platforms

Job description

Direct message the job poster from CyRAACS

*Bangalore job location with 3-6 years of professional experience*

Responsibilities:

Developing and Updating Control Frameworks

• Design, develop, and maintain comprehensive control frameworks based on global standards (ISO 27001:2022, SOC 2, CSA STAR, PCI DSS 4.0), regulations (GDPR, CCPA, DPDPA, RBI Master Directions) and frameworks (NIST CSF) for our proprietary GRC niche platform.
• Regularly review and update the frameworks to reflect changes in the regulatory landscape and information security standards.

Managing Security Certifications

• Lead the process for obtaining and maintaining security certifications such as ISO 27001:2022 and SOC 2 for the product.
• Coordinate with internal teams and external auditors to ensure all necessary documentation and evidence are prepared for audits.
• Manage timelines and project milestones to ensure timely completion of certification processes.
• Monitor and report on compliance with security standards to internal stakeholders.

Conducting User Testing

• Conduct user testing to evaluate the usability and functionality of the product.
• Gather and analyze user feedback to identify areas for improvement.
• Work with Product Management teams to translate user feedback into actionable changes and enhancements to the product.

Providing User Feedback

• Synthesize feedback from user testing sessions and ongoing user interactions to develop clear and actionable insights.
• Communicate these insights to product development teams to inform product updates and iterations.
• Establish mechanisms for continuous feedback collection to ensure that the product remains aligned with user needs and expectations.

Providing Consulting Support to Clients

• Offer expert advice and consulting support to clients regarding the implementation and optimization of the product within their operations.
• Help clients understand how to integrate the product into their existing GRC activities and how to leverage it for maximum benefit.
• Assist clients in interpreting and applying control frameworks and compliance requirements relevant to their specific industry and regulatory context.

Training and Documentation

• Develop and maintain comprehensive documentation for the product’s control frameworks and compliance features.
• Work with Product Management teams to create training materials and conduct training sessions for both internal stakeholders and external clients to ensure they are well-versed in using the product effectively.
• Stay updated with the latest developments in GRC practices, compliance regulations, and risk management strategies.
• Propose and implement improvements to the product and the internal processes based on evolving best practices and feedback.

Requirements:

Compliance and Regulatory Experience

• Experience between 3 to 6 years with GRC frameworks and standards such as ISO 27001, SOC 2, HIPAA, PCI-DSS, GDPR, etc.
• Proven track record in developing, implementing, and maintaining compliance frameworks.
• Experience in managing compliance audits and working with external auditors.

Information Security Experience

• Experience in developing information security practices, policies, and procedures.
• Experience in conducting risk assessment and end-to-end risk management practices.
• Knowledge of third-party risk management practices (TPRM).
• Experience in conducting Privacy Impact Assessments, Business Impact Analysis and developing Business Continuity Plans.
• Understanding of cybersecurity threats and mitigation strategies.

Project Management Experience

• Strong project management skills, with experience leading cross-functional projects, particularly in compliance and security certification initiatives.
• Ability to manage deadlines, coordinate with multiple stakeholders, and deliver projects on time.

Client Interaction and Support

• Experience in client-facing roles, providing consultation, training, and support.
• Skills in translating complex compliance and security requirements into actionable advice for diverse audiences.

Software and Technology

• Hands-on experience with GRC software platforms and tools preferred.
• Experience in conducting user testing and gathering feedback for software products.

Education

• Bachelor's degree in computer science, information science, or similar.
• Certified Information Systems Security Professional (CISSP) or Certified Information Security Manager (CISM)

Seniority level

Mid-Senior level

Employment type

Full-time

Job function

Consulting, Information Technology, and Project Management

Industries

IT Services and IT Consulting