GRC Specialist

IT Risk & Cybersecurity GRC

Position: GRC Specialist / Senior Analyst – Governance, Risk & Compliance

Experience: 6 Years

Industry: Insurance (Life/General/Health)/BFSI

Role Overview

We are seeking an experienced IT Risk & Cybersecurity GRC professional (6+ years) to oversee our governance, internal audit readiness, regulatory compliance posture and user access review framework within a regulated insurance environment.

The role will play a critical part in managing internal audits, IRDAI/CERT-IN compliance, user access governance, third-party risk, control testing and executive risk reporting.

The ideal candidate must have hands-on experience as both:

• An auditee for regulatory and internal audits
• A control assessor / reviewer conducting independent internal reviews

Key Responsibilities

Risk & Control Governance

• Strong understanding of IT Risk Management lifecycle (Integrated Risk Management, Risk and Control Self-Assessment, Information Risk Assessment, Business Impact Assessment)
• Perform risk assessments and control testing across IT and cybersecurity domains
• Identify control gaps and design new controls aligned with evolving threat landscape
• Track and ensure timely closure of audit observations and risk issues
• Maintain risk registers and document risk acceptance where applicable
• Coordinate security incident reporting, root cause analysis and remediation tracking.

Internal & Regulatory Audit Management

• Act as primary auditee for:
• IRDAI Cyber Security Audits
• CERT-IN compliance
• Internal audits (including Big 4)
• Financial & ITGC audits
• Coordinate evidence submission and stakeholder responses
• Conduct internal mock audits to assess control effectiveness
• Ensure 100% closure of audit issues within agreed timelines
• Track remediation and report to senior leadership

User Access Governance

• Deep understanding of:
• Privileged Access Reviews
• Normal User Access Reviews
• Role-based access control (RBAC)
• Segregation of Duties (SoD)
• Joiner-Mover-Leaver (JML) process
• Conduct periodic UAR across applications and infrastructure
• Validate access appropriateness and least privilege principles
• Coordinate with business owners and application teams for certifications
• Review PAM controls and session monitoring
• Publish interim and final access review reports

Third Party Risk Management

• Conduct third-party risk assessments during onboarding in accordance to the organization's risk tolerance
• Perform annual continuous risk reassessment
• Evaluate vendor BCP/DR capabilities
• Ensure contractual security clauses are aligned with regulatory expectations
• Track vendor remediation actions

KPI / KRI / KCI Management

• Define and track security KPIs, KRIs and KCIs
• Develop risk dashboards for senior management and governance forums
• Present risk posture updates to leadership

Regulatory Compliance (Insurance Sector)

• Interpret and implement circulars from:
• IRDAI
• CERT-IN
• Other applicable regulators
• Translate regulatory expectations into actionable control implementations
• Conduct gap assessments against regulatory mandates especially the DPDP act
• Drive remediation programs

Policy & Framework Management

• Review and update ISMS and BCMS policies and procedures
• Align with ISO 27001, internal group standards and regulatory requirements
• Drive policy modernization initiatives
• Coordinate with cross-functional teams to ensure policy adoption and compliance.

Business Continuity & DR

• Support Business Continuity Planning (BCP) and Disaster Recovery (DR) compliance requirements.
• Participate in DR drills and ensure documentation readiness.
• Creating and analyzing weighted, risk-based matrix to categorize applications based on their business and information security criticality.

GRC Platforms & Reporting

• Hands-on experience with GRC tools such as:
• IBM OpenPages (preferred)
• Archer / MetricStream / equivalent
• Maintain risk registers and issue trackers
• Generate dashboards and executive reports

Security Awareness & Training

• Design and rollout training programs in accordance to the evolving threat landscape
• Support awareness initiatives to uplift control maturity

Mandatory Skills & Experience

• 6+ years in IT Risk / Cybersecurity GRC (BFSI/Insurance preferred)
• Strong audit handling experience (IRDAI exposure highly preferred)
• Demonstrated experience in User Access Reviews (non-negotiable)
• Experience with PAM, access governance and audit evidence validation
• Good understanding of IT infrastructure, cybersecurity concepts and vendor risk processes.
• Strong communication, documentation & reporting skills
• Exposure to senior governance forums
• Ability to independently drive remediation
• Analytical thinking and problem-solving.
• Attention to detail and ability to handle multiple compliance workstreams.

Preferred Qualifications

• Bachelor's degree in IT, Computer Science, Engineering, or related field.
• ISO 27001 Lead Implementer / Auditor
• CISA / CRISC / CISSP (added advantage)
• Experience in regulated insurance environment

What We Are Looking For

A hands-on, detail-oriented, audit-mature GRC professional who:

• Can independently manage regulatory interactions
• Understands risk deeply (not checklist-based)
• Has strong user access governance expertise
• Can present confidently to senior leadership
• Can drive closure without supervision