Information Security Analyst (GRC & Vulnerability Management)

Key Responsibilities

Perform infrastructure vulnerability assessments using Nessus and prepare vulnerability reports.

Work with infrastructure and application teams to track and validate vulnerability remediation.

Support internal and external security audits by collecting evidence, preparing documentation, and coordinating with stakeholders.

Conduct risk assessments across business units, identify security risks, and recommend mitigation measures.

Maintain and update risk registers and track remediation activities.

Participate in incident response activities by providing risk analysis and supporting remediation efforts.

Assist in implementing security controls and automation to reduce business risks. Perform gap assessments against the RBI Cyber Security Framework and support implementation of required controls.

Monitor compliance with organizational security policies and regulatory requirements. Coordinate with business, IT, and security teams to improve the organizations overall security posture.

Required Skills

4+ years of relevant experience in Information Security, GRC, Risk Management, or Vulnerability Management.

Hands-on experience with Nessus for vulnerability assessment and reporting.

Good understanding of information security audits and compliance activities.

Experience conducting risk assessments and managing risk registers.

Familiarity with the RBI Cyber Security Framework and experience performing compliance or gap assessments.

Knowledge of security frameworks such as NIST CSF, CIS Controls, ISO 27001, HIPAA, and similar standards.

Basic understanding of incident response processes and security best practices. Good communication and stakeholder management skills.

Ability to prepare reports and present findings to technical and business teams.

Preferred Skills Experience in the Banking, Financial Services, or NBFC sector.

Exposure to vulnerability remediation tracking and security governance.

Relevant certifications such as Security+, ISO 27001, CISA, CISM, CRISC, or similar are an added advantage.