GRC Consultant

Role & Responsibilities

• Conduct information security risk assessments, gap assessments, and compliance reviews against applicable standards and regulatory requirements.
• Support the implementation and maintenance of Information Security Management Systems (ISMS) as per ISO 27001.
• Work with cybersecurity frameworks and standards, including ISO 27001, ISO 22301, PCI DSS, NIST CSF, NIST SP 800-53, and the DPDP Act, 2023.
• Conduct internal audits, audit-readiness assessments, and regulatory compliance assessments.
• Assess applicable regulatory requirements, circulars, guidelines, and advisories issued by RBI, SEBI, IRDAI, UIDAI, and other relevant authorities.
• Develop and review information security policies, procedures, standards, and control documentation.
• Identify compliance gaps, document audit findings, recommend remediation measures, and track corrective actions.
• Prepare audit plans, checklists, risk registers, compliance reports, and management presentations.
• Assess the effectiveness of security controls relating to access management, data protection, encryption, vulnerability management, and incident response.
• Support business continuity planning (BCP), disaster recovery (DR), and incident response assessments.
• Coordinate with clients and internal stakeholders for evidence collection, audit activities, remediation tracking, and project deliverables.
• Maintain accurate documentation and ensure timely completion of assigned GRC consulting engagements.

Preferred Candidate Profile

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related discipline.
• Relevant experience in Governance, Risk & Compliance (GRC), information security, IT audit, cybersecurity consulting, or regulatory compliance.
• Strong understanding of ISO 27001 and information security risk assessment methodologies.
• Familiarity with ISO 22301, PCI DSS, NIST CSF, NIST SP 800-53, and the DPDP Act, 2023.
• Exposure to regulatory compliance requirements issued by RBI, SEBI, IRDAI, UIDAI, or other relevant regulatory bodies.
• Experience in internal audits, gap assessments, control testing, audit documentation, and remediation tracking.
• Working knowledge of IT infrastructure, networks, security controls, data protection, and encryption concepts.
• Excellent documentation, analytical, communication, and stakeholder management skills.
• Ability to manage multiple assignments and work effectively in a client-facing consulting environment.
• Certifications such as ISO 27001 Lead Auditor/Lead Implementer, CISA, CISM, CRISC, or CISSP will be an added advantage.
• Candidates with a proactive approach, attention to detail, and a strong interest in cybersecurity governance and compliance are preferred.

Location: Mumbai / PuneRole & responsibilities

Preferred candidate profile