GRC Analyst

Job Summary

Security Brigade is hiring a GRC Analyst to join our compliance and audit practice. You will work directly with enterprise customers across BFSI, fintech, healthcare, SaaS, and government to deliver structured compliance engagements across India and global frameworks - RBI, SEBI, IRDAI, CERT-In, UIDAI AUA-KUA, NPCI / UPI, SAR, ISO 27001, SOC 2, PCI DSS, HIPAA, GDPR, and DPDP.

You will run gap assessments, policy and control reviews, evidence collection, remediation planning, and audit-cycle closure - all backed by our Lemon platform for evidence and tracking. The role pairs you with senior compliance leadership for mentorship and with our offensive security teams for technical control validation.

Responsibilities

• Run gap assessments against the framework that applies to the customer (ISO 27001, SOC 2, RBI, SEBI, IRDAI, DPDP, etc.)
• Map customer policies, processes, and technical controls to framework requirements
• Lead evidence-collection workflows; coordinate with customer engineering, IT, and operations teams
• Draft regulator-ready or auditor-ready deliverables - gap reports, control matrices, remediation trackers, board-summary packs
• Partner with our offensive security and audit teams to validate technical control effectiveness, not just policy presence
• Manage engagement timelines and stakeholder communication
• Drive remediation cycles and closure validation through to final certification or attestation
• Contribute to internal frameworks, templates, and Lemon platform improvements

Qualifications

• 2-4 years of GRC, compliance, internal audit, or risk-management experience in a services / consulting environment
• Working knowledge of at least three major frameworks: ISO 27001, SOC 2, PCI DSS, RBI cybersecurity, SEBI CSCRF, IRDAI, HIPAA, GDPR, or DPDP
• Comfortable running gap assessments, control reviews, and evidence-collection workflows end-to-end
• Strong written communication - your reports go to CISOs, audit committees, and regulators
• Comfortable working customer-side: meeting cadence, evidence requests, escalation handling
• Ability to run multiple parallel engagements without dropping rigour
• Working knowledge of cybersecurity controls beyond paperwork - you do not have to be a hands-on tester, but you should reason about technical controls credibly

Quick Facts

• Team: Compliance
• Location: Delhi / Mumbai / Remote
• Type: Full-time
• Level: Mid
• Posted:

Disclaimer: This job posting & location has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.