GRC Analyst

Key Responsibilities:

• Support the implementation of cybersecurity frameworks such as ISO 27001 (ISMS), ISO 27701 (PIMS), ISO 42001 (AIMS), SOC 2, NIST, PCI DSS, GDPR, HIPAA and other compliance standards from a technical GRC perspective.
  
• Conduct risk assessments, gap analyses, and security audits to identify vulnerabilities and recommend actionable mitigation strategies.
  
• Assist clients in securing their cloud environments (AWS,Azure, GCP) by providing guidance on cloud security best practices.
  
• Support clients in developing and implementing security policies, governance models, and technical controls.
  
• Contribute to security architecture reviews and support secure solution design for cloud environments.
  
• Deliver GRC advisory services, aligning security strategies with regulatory and business requirements.
  
• Collaborate with IT, Security, Legal, and Business teams to align GRC initiatives with organizational goals.
  
• Stay informed about evolving cyber threats, regulations, and standards to enhance advisory services.
  
• Manage third-party risk assessments and vendor security posture.
  

• Lead internal and external audits, prepare documentation, and coordinate with auditors. Maintain defensible audit trails and compliance reports.
  
• Deliver security awareness and training sessions to client teams.
  
• Mentor and guide junior team members in GRC practices.
  

Soft Skills:

• Bachelor’s or Master’s degree in Cybersecurity, Information Technology, or related field.
  
• 4 - 6 years of experience in cybersecurity consulting, implementation, or GRC advisory.
  
• Solid knowledge of ISO 27001, SOC 2, NIST CSF, PCI DSS, GDPR, and other regulatory frameworks.
  
• Hands-on experience in cloud security (AWS/Azure/ GCP) and implementation of security controls.
  
• Strong understanding of risk assessment, control implementation, and compliance validation processes.
  
• Effective communicator with the ability to engage both technical and business stakeholders.
  

• Strong organizational and documentation skills.
  

Preferred Certifications:

• CISSP, CISA, ISO 27001 LI/LA, CRISC, or equivalent (at least one is highly desirable).