Associate GRC Consultant

Key Responsibilities:

1. ISO27001 Implementation and Management

• Develop and implement an Information Security Management System (ISMS) as per ISO27001:2022 standards.
• Conduct regular gap assessments, risk mapping and evaluations, and maintain ISMS documentation.
• Drive the ISO27001 certification process and manage ongoing compliance.

2. Internal Audits and Risk Assessments

• Plan, execute, and document internal security audits to ensure adherence to organisational policies and regulatory standards.
• Identify gaps, recommend corrective actions, and monitor their implementation.
• Conduct periodic risk assessments to mitigate emerging threats.

3. Regulatory Compliance

• Ensure full compliance with RBI and SEBI cybersecurity guidelines, including IT governance, resilience, and data protection requirements.
• Stay updated on regulatory changes and advise the organization on necessary adjustments.
• Oversee the preparation and submission of compliance reports to regulatory bodies.

4. Cybersecurity and Resilience

• Develop and implement strategies to enhance the organization's cybersecurity posture and operational resilience.
• Monitor and enforce security controls such as access management, data encryption, and incident response readiness.
• Collaborate with IT teams to ensure secure infrastructure and application development practices.

5. Policy Development and Awareness

• Draft and update cybersecurity and IT compliance policies to align with ISO27001, RBI, SEBI, and other standards.
• Conduct training and awareness programs for employees to foster a security first culture.

6. Incident Management

• Lead the development and testing of incident response plans, ensuring quick and effective handling of security events.
• Provide insights and corrective measures post-incident, enhancing future resilience.

7. Vendor and Third-Party Risk Management

• Evaluate third-party vendors and service providers for compliance with security and regulatory standards.
• Develop frameworks for monitoring vendor performance and adherence to contracts.

8. Continuous Improvement

• Identify opportunities for improving IT governance, data protection, and compliance frameworks.
• Leverage technology and automation to streamline security and compliance processes.

Requirements:

• Strong understanding of RBI, SEBI, and other Indian regulatory frameworks.
• Expertise in internal audits and risk management.
• Excellent communication and presentation skills, stakeholder management, and problem-solving skills.
• Familiarity with tools and frameworks related to vulnerability management, SIEM, and compliance monitoring.

Qualifications

• Education: Bachelor's degree in IT, Computer Science, or a related field.
• Certifications: ISO27001 Lead Auditor Preferred
• Experience: Proven experience in information security, regulatory compliance, and implementing ISO27001 standards.

Benefits:

• Flat Hierarchy: Enjoy a collaborative environment where every voice matters.
• Flexible Work Hours: Tailor your schedule to fit your lifestyle and enhance work-life balance.
• Dynamic Team: Join a vibrant, forward-thinking group of young professionals.
• Inclusive Culture: Experience an open and supportive work atmosphere that encourages creativity.
• Career Development: Benefit from structured career paths that align with your goals.
• Mentorship Opportunities: Receive guidance and support from experienced mentors to help you grow.

Pay: ₹400,000.00 - ₹600,000.00 per year

Application Question(s):

• Do you have knowledge of ISO 27001:2022?
• Are you familiar with the Digital Personal Data Protection (DPDP) Act, 2023?
• Do you understand Third-Party Risk Management (TPRM)?
• Are you familiar with risk assessments and gap assessments in information security?
• How much relevant experience do you have in GRC, information security, compliance, or risk management?
• Are you willing to work from our Mumbai location?

Work Location: In person