Consultant - GRC ( Governance Risk and Compliance ) - Bangalore locals

Core Responsibilities

Governance & Policy Management

Maintain and update the security policy library using standardized templates and version controls.

Track ownership, reviews, and approvals of security governance documents.

Support communication and awareness of policy changes across IT and security teams.

Risk & Compliance Management

Assist in maintaining the enterprise cybersecurity risk register, ensuring risks are properlydocumented, assessed, and tracked to remediation.

Help monitor compliance with security frameworks (ISO 27001, SOC 2, NIST CSF, PCI-DSS, GDPR, PIPEDA).

Prepare and manage documentation and evidence for internal and external audits.

Support global readiness efforts for certifications such as ISO 27001 and SOC 2.

Vendor Risk Management

Conduct vendor security due diligence and assessments based on tiering criteria(criticality, data access, geography).

Validate vendor certifications (SOC 2, ISO 27001, PCI, etc.) and monitor reassessment schedules.

Document findings, exceptions, and risk mitigations in Jira or other approved tools.

Exception & Risk Acceptance Tracking

Manage intake, approval, and expiry tracking for policy exceptions and risk acceptances.

Ensure each exception has clear justification, defined expiration, and mitigation plan..

Metrics & Reporting

Support development of dashboards and reports tracking Key Risk Indicators (KRIs),policy reviews, vendor status, and audit results.

Assist in preparing quarterly GRC summary reports for senior management.

Required Qualifications

Bachelors degree in information security, Computer Science, Risk Management, or a related discipline.

About 5 years of experience in GRC, IT audit, cybersecurity compliance, or risk management.

Familiarity with major frameworks: ISO/IEC 27001, NIST CSF, SOC 2, GDPR, PCI-DSS.

Experience supporting audits or control testing activities.

Strong documentation and coordination skills.

Proficiency with collaboration and workflow tools (e.g., Jira, Confluence, Microsoft Teams/SharePoint, Excel, PowerPoint).

Excellent written and verbal English communication skills (role supports global stakeholders).

Ability to work independently with global teams across multiple time zones.

Experience supporting ISO 27001 certification or SOC 2 readiness.

Prior exposure to vendor risk management processes or tools.

Certifications such as ISO 27001 Lead Implementer, CISA, CRISC, or CGRC (CAP).

Knowledge of security reporting or dashboarding (Power BI, Tableau, or similar).