GRC Specialist

Keka Inc.; Hyderabad City Taluka; On-site; PKR 1,800,000 - 3,000,000; Full time

Job summary

Keka Inc. seeks a hands-on GRC Specialist to support information security governance, risk assessments, and audit activities across BFSI-aligned environments. You will collaborate with security engineering, cloud, and IAM teams to ensure evidence-ready controls and compliant processes.

The role emphasizes documenting controls, maintaining policy hygiene, and driving remediation with clear action plans for leadership. Strong cross-functional communication is essential.

Qualifications

• 6+ years in information security GRC, IT risk, audit, or compliance (hands-on delivery).
• Experience supporting audits and control evidence in enterprise environments.
• BFSI or regulated-industry experience preferred.

Responsibilities

• Support and maintain the information security governance framework, policies, standards, and control library
• Plan and execute security risk assessments
• Track findings, remediation owners, and closure evidence
• Support regulatory and audit engagement (SOC 1/2, ISO 27001, PCI DSS)
• Gather, organize, and quality-check audit and compliance evidence across security, IAM, cloud, and engineering teams
• Maintain risk registers and compliance reporting packs
• Coordinate with DevSecOps, IAM/CIAM, and security operations teams to map controls to GRC obligations
• Contribute to GRC runbooks and process documentation
• Escalate material risk, audit, or compliance issues with recommended actions

Skills

GRC

Risk assessment

Audit support

Policy development

Stakeholder coordination

Tools

ServiceNow GRC

Archer

Job description

GRC Specialist Role Summary: Hands-on Governance, Risk, and Compliance (GRC) specialist supporting a banking/financial services client’s information security program—owning control design/evidence, risk assessments, audit/regulatory support, and policy/process hygiene day to day (individual contributor; not a deputy CISO role).

Key Responsibilities:

• Support and maintain the information security governance framework, policies, standards, and control library
• Plan and execute security risk assessments
• track findings, remediation owners, and closure evidence
• Support regulatory and audit engagement (e.g., SOC 1/2, ISO 27001, PCI DSS, and BFSI/regulator-equivalent expectations as applicable)
• Gather, organize, and quality-check audit and compliance evidence across security, IAM, cloud, and engineering teams
• Maintain risk registers, control testing schedules, exceptions/waivers, and compliance reporting packs
• Support third-party/vendor risk reviews and ongoing due-diligence evidence where required
• Coordinate with DevSecOps, IAM/CIAM, and security operations teams to map technical controls to GRC obligations
• Contribute to GRC runbooks, process documentation, and continuous improvement of compliance workflows
• Escalate material risk, audit, or compliance issues to senior leadership with clear impact and recommended actions

Required Experience:

• 6+ years in information security GRC, IT risk, audit, or compliance (hands-on delivery; not pure program leadership)
• Experience supporting audits and control evidence in enterprise environments
• BFSI or other regulated-industry experience preferred (banking, payments, insurance, or capital markets)
• Comfortable working with technical teams (security engineering, cloud, IAM) to translate controls into testable evidence

Core Technical Expertise:

• Security governance, risk & compliance (GRC)
• Control frameworks and audits: ISO 27001, SOC 1/2, PCI DSS (as applicable)
• NIST CSF familiarity a plus
• Risk assessment, control testing, issue management, and remediation tracking
• Policy, standard, and procedure development/maintenance
• Audit evidence management and stakeholder coordination
• Third-party/vendor risk fundamentals (preferred)
• Familiarity with GRC tooling (e.g., ServiceNow GRC, Archer, or equivalent) preferred

Preferred Certifications:

• CISA, CISM, ISO 27001 Lead Auditor/Implementer, CRISC, or equivalent (as applicable)