Associate - IT Risk & Cybersecurity

ASSOCIATE IT RISK & CYBERSECURITY

Company: Cybervahak Consultants Private Limited

Experience: 01 Year

Location: Mumbai

Employment Type: Full-Time

Work Mode: Work from Office, with Travel to Client Sites

ABOUT THE ROLE

We are looking for an Associate IT Risk & Cybersecurity who can perform detailed IT risk assessments, evaluate security controls, examine technical evidence, identify gaps and prepare defensible assessment findings.

You will work directly on client engagements alongside the engagement lead, take ownership of assigned deliverables and explain the technical and risk-based reasoning behind your conclusions.

Freshers and candidates with up to one year of experience are eligible. Strong fundamentals, practical preparation, analytical ability and clear written communication are essential.

Relevant college projects, internships, independent assessments and lab-based work will be considered.

You must be able to demonstrate your own contributions and justify your conclusions.

KEY RESPONSIBILITIES

1. IT Risk Assessment & Control Testing

• Conduct IT risk assessments, process walkthroughs, evidence collection, sampling and control testing.
• Evaluate control design and operating effectiveness and maintain complete, traceable working papers.
• Assess IT general controls (ITGC) and cybersecurity controls across on-premises, cloud and outsourced environments.
• Test access management, segregation of duties, change management, IT operations, asset and configuration management, patching, vulnerability management, logging and monitoring.
• Evaluate backup, recovery, incident management and related operational controls.
• Develop and update risk registers based on assets, business processes, threats, vulnerabilities, likelihood and business impact.
• Document existing controls, residual risks, treatment plans and relevant risk indicators.
• Draft audit findings supported by evidence, root-cause analysis, business impact, justified risk ratings and actionable remediation recommendations.
• Discuss observations with client stakeholders and verify the closure of corrective actions.
• Review third-party risk assessments, outsourcing controls, due diligence records, contractual requirements and vendor monitoring evidence.
• Analyse SOC 1 and SOC 2 reports, identify limitations and document follow-up requirements.

2. Regulatory Compliance & Cybersecurity Governance

• Conduct compliance gap assessments, applicability mapping and readiness reviews.
• Evaluate client compliance against relevant RBI, SEBI, IRDAI and CERT-In requirements.
• Assess alignment with frameworks including ISO/IEC 27001, NIST CSF, CIS Controls and PCI DSS.
• Draft and update information security policies, standards, procedures and standard operating procedures (SOPs).
• Prepare compliance evidence, assessment reports, remediation trackers and supporting documentation.
• Support regulatory inspections, internal audits and certification assessments.
• Identify applicable regulatory requirements, interpret their relevance and map them to practical technical and organisational controls.

3. Data Privacy, Business Continuity & Cyber Crisis Readiness

• Assist in privacy assessments under applicable data protection requirements, including the Digital Personal Data Protection Act.
• Conduct data inventory reviews and prepare inputs for privacy impact assessments.
• Assess consent, retention, personal data handling and breach-readiness controls.
• Review business continuity plans (BCP), disaster recovery plans (DRP), recovery objectives and testing evidence.
• Participate in disaster recovery test observations and document identified gaps.
• Develop realistic cyber crisis scenarios, tabletop exercise material and simulation injects.
• Assist in conducting cyber crisis simulations and cybersecurity awareness sessions, including leadership awareness programmes.

4. AI Governance & Technology-Enabled Assurance

• Assess AI use cases using ISO/IEC 42001 and the NIST AI Risk Management Framework.
• Prepare AI model and use-case inventories, risk classifications and supporting assessment documentation.
• Examine risks related to AI privacy, security, bias, accuracy, transparency and human oversight.
• Use Excel, scripts, dashboards and approved AI tools to analyse audit evidence, logs and configurations.
• Validate analytical outputs against underlying evidence and comply with client confidentiality and approved data-handling requirements.
• Develop reusable assessment checklists, risk registers, working papers and reporting templates.
• Track assigned client requests, deliverables and deadlines, and escalate delivery risks appropriately.
• Contribute research, technical inputs and scoping support for cybersecurity proposals and engagements.

REQUIRED TECHNICAL & PROFESSIONAL SKILLS

1. IT Audit & Risk Assessment

• Understanding of IT auditing, risk assessment methodologies and internal control frameworks.
• Knowledge of walkthroughs, control objectives, sampling, evidence collection and audit documentation.
• Ability to differentiate control design effectiveness from operating effectiveness.
• Familiarity with ITGC, risk registers, audit findings and remediation tracking.
• Awareness of ISACA and Institute of Internal Auditors (IIA) audit practices.

2. Technical Cybersecurity Fundamentals

• Working knowledge of computer networks, Windows, Linux and identity and access management.
• Understanding of cloud security, shared responsibility, encryption and security architecture.
• Ability to evaluate security configurations and supporting control evidence.
• Understanding of vulnerability assessments and penetration testing (VAPT) reports.
• Ability to assess vulnerability remediation evidence and incident detection, response and reporting readiness.

3. Regulatory & Compliance Knowledge

• Working knowledge of relevant RBI cybersecurity, IT governance and outsourcing requirements for banks, NBFCs and payment operators.
• Familiarity with SEBI cybersecurity and system audit requirements.
• Understanding of CERT-In directions and applicable data protection requirements.
• Familiarity with ISO/IEC 27001, ISO/IEC 27002, ISO/IEC 27701, ISO 22301, NIST CSF, CIS Controls, PCI DSS and the CSA Cloud Controls Matrix.
• Ability to locate authoritative requirements and explain how they translate into practical controls and evidence.

4. AI Governance & Emerging Technologies

• Foundational understanding of artificial intelligence, machine learning and large language models.
• Familiarity with prompt engineering, model risk and responsible AI concepts.
• Working knowledge of ISO/IEC 42001 and the NIST AI Risk Management Framework.

5. Data Analysis & Reporting

• Strong working knowledge of Microsoft Excel, including lookups, pivot tables, data validation and evidence reconciliation.
• Ability to analyse datasets, identify inconsistencies and present clear findings.
• Exposure to Python, Power BI or similar analytical and automation tools is an advantage.
• Strong written English, technical documentation and professional communication.
• Ability to distinguish evidence-backed findings from unsupported statements and business risks from documentation gaps.

QUALIFICATIONS & PRACTICAL EXPERIENCE

• Degree in Engineering, Computer Science, Information Technology, Cybersecurity or a related discipline.
• Fresher or up to one year of relevant professional experience.
• Demonstrable interest and practical work in IT risk, cybersecurity, auditing or compliance.

Relevant practical experience may include:

• An IT risk assessment or control-testing project.
• Security configuration review or cybersecurity assessment.
• Drafting audit findings, risk registers or remediation plans.
• An information security policy or compliance project.
• Relevant internships, independent research or practical case studies.

Self-created case studies and properly anonymised work samples are welcome.

ADDITIONAL SKILLS & CERTIFICATIONS (GOOD TO HAVE)

• Relevant certifications or progress towards ISO/IEC 27001, CISA, CRISC or CISM.
• Exposure to GRC platforms and compliance management tools.
• Understanding of SOC 2 or ISAE 3402 engagements.
• Practical exposure to cloud security, privacy assessments or AI governance.
• Interest in pursuing additional professional qualifications as responsibilities grow.

WHAT WE EXPECT FROM YOU

• Take ownership of assigned tasks and deliverables.
• Investigate thoroughly before raising questions or escalating issues.
• Apply evidence-based reasoning and maintain accuracy in working papers and reports.
• Demonstrate professional integrity when findings are challenged.
• Manage confidential client information responsibly.
• Communicate clearly with team members and client stakeholders.
• Accept technical review feedback and continuously improve the quality of your work.
• Show initiative in learning unfamiliar regulations, technologies and assessment methodologies.

WHAT WE OFFER

• Hands-on exposure to IT audits, risk assessments, cybersecurity governance and regulatory compliance.
• Opportunities to work on client engagements across financial services and other industries.
• Practical involvement in cyber crisis simulations, privacy assessments, AI governance and security engineering.
• Direct feedback and guidance from experienced cybersecurity professionals.
• Opportunities to take on broader responsibilities based on demonstrated competence.
• Compensation aligned with demonstrated capability.

KEY SKILLS

IT Audit, IT Risk Assessment, ITGC, Cybersecurity Audit, Control Testing, GRC, ISO 27001, RBI Compliance, SEBI Compliance, CERT-In, Data Privacy, Third Party Risk Management, BCP, Disaster Recovery, AI Governance, NIST CSF, Excel, Python, Report Writing