Senior GRC Analyst - Information Security

True Balance; Gurugram District; On-site; INR 1,800,000 - 2,800,000; Full time

Job summary

True Balance, a BalanceHero Group company and RBI-licensed PPI issuer, seeks a Senior GRC Analyst to lead governance, risk, and compliance operations. You will partner with engineering, IT, security, product, and legal teams to automate processes, enhance security posture, and drive continuous improvement.

The role emphasizes risk management, third-party oversight, and regulatory compliance, including RBI, ISO 27001, and SOC 2, in a fast-paced FinTech environment.

Qualifications

• Bachelor’s degree in information security, Computer Science, Risk Management, or a related technical field.
• Approximately 5 years of dedicated experience in GRC, Information Security, Risk Management, Security Operations, IAM, and RBI compliance.
• Strong knowledge of ISO 27001, ISO 22301, SOC 2, NIST CSF, and CIS.
• Hands-on experience with SIEM platforms and vulnerability management governance.

Responsibilities

• Lead enterprise GRC operations and drive assurance activities with cross-functional teams.
• Manage third-party risk, vendor assessments, due diligence, and risk registers.
• Coordinate compliance activities, audits, evidence collection, and remediation tracking.
• Oversee IAM, access governance, SoD controls, and asset lifecycle governance.
• Monitor security operations, incident response, vulnerability management, and SOC coordination.

Skills

GRC

InfoSec

Risk management

Stakeholder mgmt

Documentation

Education

Bachelor’s degree in information security

Tools

SIEM platforms

Vulnerability management

Security monitoring tools

Job description

About True Balance

Owned and operated by BalanceHero Group, True Balance is an RBI authorized Prepaid Payment Instrument (PPI) issuing entity. It offers loans through its subsidiary and RBI licensed Non-Banking Financial Company - True Credits Private Limited and other RBI licensed partners. Founded in 2016, as a mobile app for users in India to efficiently manage their phone calls and data usage, True Balance is now India’s one of the top financial services platforms providing solutions to all the financial needs of its users - from obtaining instant loans, paying utility bills to do prepaid recharges seamlessly. To date, True Balance has raised more than US$84 million in equity funding from marquee global investors like Softbank, Naver, and Line to name a few. The company aims to become the go-to financial services platform for the next billion people in India, playing a key role in the nationwide push towards the goal of Digital India and advancing financial inclusion amongst the unbanked and underbanked people.

Job Description

Role: Senior GRC Analyst / GRC Specialist (Information Security)

We are seeking a seasoned Senior Governance, Risk, and Compliance (GRC) Analyst / Specialist with approximately 5 years of experience to lead and execute our core information security governance, risk management, and compliance operations.

In this role, you will own day-to-day GRC operations, acting as the primary operational point of contact for assurance activities. You will collaborate closely with internal engineering, IT, security operations, product, and legal teams, as well as external vendors. The ideal candidate is a self-starter who can drive continuous improvement, automate manual processes, and elevate the organization's overall security and compliance posture.

Key Responsibilities

1. Risk Management & Governance

• Maintain the enterprise and operational risk registers, conducting risk assessments across business and technology functions.
• Track risk treatment plans, monitor mitigation activities, and ensure the timely closure of identified risks.
• Prepare GRC and security metrics, dashboards, and management reports, tracking key performance indicators (KPIs) and key risk indicators (KRIs).

2. Third-Party Risk Management (TPRM)

• Manage end-to-end TPRM activities, including vendor onboarding assessments, due diligence reviews, and periodic reassessments.
• Review vendor security questionnaires, audit reports (SOC 2, ISO), certifications, and remediation plans.
• Maintain vendor risk registers, track outstanding findings, and monitor risk closure.

3. Compliance, Audit, & Control Monitoring

• Perform control monitoring and effectiveness reviews to validate compliance with internal policies, ISO 27001, and regulatory obligations (e.g., RBI compliance).
• Support internal and external audits by coordinating evidence collection, responding to auditor requests, and tracking remediation actions.
• Manage customer security assessments, due diligence requests, and security questionnaire responses.

4. Identity & Access Governance (IAM) & Asset Management

• Coordinate periodic user access, privileged access, and single sign-on (SSO) reviews.
• Validate user provisioning, deprovisioning, role changes, and segregation of duties (SoD) controls.
• Conduct periodic asset inventory reviews to ensure asset ownership, classification, and lifecycle compliance; drive remediation for unmanaged or orphaned assets.

5. Incident Management / SOC

• Monitor security alerts generated by SOC, SIEM, and application logs, coordinating with relevant technical teams for investigation and remediation.
• Track security incidents, document findings, monitor corrective actions, and elevate critical risks.
• Govern the vulnerability management process, tracking remediation timelines and reporting overdue vulnerabilities.

6. Security Operations

• Conducting periodic hardening review of cloud, servers, endpoints and network devices.
• Performing patch compliance review for endpoints on periodic basis.

Required Qualifications

• Education: Bachelor’s degree in information security, Computer Science, Risk Management, or a related technical field.
• Experience: Approximately 5 years of dedicated experience in GRC, Information Security, Risk Management, Security Operations, IAM, and RBI compliance.
• Frameworks: Strong foundational knowledge of security standards and frameworks, specifically ISO 27001, ISO 22301, SOC 2, NIST CSF, and CIS.
• Technical Familiarity: Hands-on experience working with SIEM platforms, security monitoring tools, and vulnerability management governance.
• Soft Skills: Excellent stakeholder management, cross-functional collaboration, and strong documentation/reporting skills (advanced MS Excel/Word).

Preferred Qualifications

• Certifications: ISO 27001 Lead Implementer / Lead Auditor, CISA, CRISC, or security-specific certifications.
• Industry Experience: Prior experience working within NBFC, PPI, SaaS, FinTech, or fast-paced product-based organizations in regulated industry.
• Cloud Governance: Direct exposure to cloud security governance, preferably within Amazon Web Services (AWS) environments.

Education: Bachelor’s degree in information security, Computer Science, Risk Management, or a related technical field.

We are seeking a seasoned Senior Governance, Risk, and Compliance (GRC) Analyst / Specialist with approximately 5 years of experience to lead and execute our core information security governance, risk management, and compliance operations.

In this role, you will own day-to-day GRC operations, acting as the primary operational point of contact for assurance activities. You will collaborate closely with internal engineering, IT, security operations, product, and legal teams, as well as external vendors. The ideal candidate is a self-starter who can drive continuous improvement, automate manual processes, and elevate the organization's overall security and compliance posture.