Information Technology Risk Management L2 Support & GRC Analyst

ITRM L2 Support & GRC Analyst

Job Title: IT Risk Management Analyst L2 Support

Department: Information Security / IT Governance

Location: Noida Sector 125

Experience: 5- 10 years

Employment Type: Full-Time

Required - Immedaite Joiner

1. Role Overview

The IT Risk Management L2 Support & GRC Analyst will be responsible for supporting IT risk processes, regulatory compliance reporting, governance activities, technical risk assessments, internal/external audit support, and cybersecurity governance functions.
The role involves hands-on experience in risk analysis, compliance monitoring, evidence collection, report writing, VAPT interpretation, and mapping controls to frameworks such as RBI, CERT-In, UIDAI, NSDL, and HIPAA.

2. Key Responsibilities

A. IT Risk Management & Governance

• Conduct technology risk assessments, gap analysis, and risk scoring across IT systems, applications, infrastructure, and vendor environments.
• Assist in the development and maintenance of Risk Registers, Issue Trackers, and Corrective Action Plans.
• Perform RCSA (Risk Control Self-Assessment) activities, including identification of key risks, controls, and mitigation actions.
• Support IT risk governance meetings by preparing dashboards, status reports, and risk metrics.

B. GRC (Governance, Risk & Compliance) Operations

• Manage and update controls within GRC platforms (Archer, ServiceNow GRC, Metric Streamor internal equivalents).
• Map controls to frameworks such as, COBIT, HIPAA, PCI DSS (as applicable).
• Monitor control performance and support periodic control testing.
• Perform policy compliance assessments and track deviations/exceptions.

C. Regulatory Reporting & Compliance (RBI, IRDAI, CERT-In, NSDL, UIDAI)

• Prepare and submit periodic regulatory reports such as:
• RBI Cyber Security Incident Reporting, System Audit, Cyber Drill Compliance
• IRDAI Cyber Security Guidelines Compliance & Audit Inputs
• CERT-In Incident Reporting & Monthly/Quarterly Submissions
• UIDAI Security Audits & Compliance Reports
• NSDL/CRA guidelines compliance
• Liaise with internal stakeholders for gathering evidence and validating data for regulatory submissions.
• Track changes in regulatory requirements and ensure timely implementation in processes.

D. Audit Support (Internal, External, Statutory)

• Coordinate with IT, Infosec, and internal & external auditors for audits such as:
• CSITE, Statutory
• RBI/IRDAI/CERT-In mandated audits
• Internal IT & Cybersecurity audits
• Vendor security assessments
• Collect, verify, and organize audit evidence as per auditor expectations.
• Maintain audit trail, evidence repository, and noncompliance trackers.
• Map audit findings to risk categories and track closure of observations.

E. Technical Skills VAPT Understanding & Security Concepts

• Understand VAPT reports, identify technical vulnerabilities, and map them to risk impact.
• Work with SOC/Infra/Application teams for remediation tracking and evidence validation.
• Support patch management, vulnerability closure, and secure configuration initiatives.
• Understand common security domains: network security, application security, cloud controls, identity access management.

F. Documentation & Report Writing

• Prepare high-quality risk reports, regulatory submissions, audit reports, and management dashboards.
• Draft Standard Operating Procedures (SOPs), compliance summaries, and policy updates.
• Document process gaps, risks, and required controls in a clear and structured manner.

3. Required Skills & Competencies

Technical & Functional Skills

• Strong understanding of:
• RBI Cyber Security Framework & Baseline Controls
• CERT-In 2022 Guidelines
• HIPAA Security Rule (if applicable)
• Good knowledge of Vulnerability Assessment & Penetration Testing (VAPT) cycles.
• Experience in audit evidence management, documentation control, and compliance reporting.
• Ability to think analytically to identify and assess technology risks.

Soft Skills

• Excellent written communication (strong report-writing ability).
• Good stakeholder coordination across IT, Security, Operations, and Audit.
• Ability to work independently and in fast-paced regulatory environments.
• Problem-solving mindset, attention to detail, and structured thinking.

4. Educational Qualifications

• Bachelors degree in computer science, IT, Electronics, Cyber Security, or related field.
• Preferred Certifications (any one or more):
• CEH / Security+ / CCSP (optional)
• NIST CSF Foundation
• ITIL (for L2 support/gov processes)
• CRISC / CISA (added advantage)

5. Key Performance Indicators (KPIs)

• Timely submission of regulatory reports.
• Reduction in open audit findings.
• Closure timelines for vulnerabilities & risks.
• Accuracy and completeness of documentation.
• Compliance score improvement (RBI frameworks).
• Efficiency in RCSA completion & control testing