IT Risk & Cybersecurity GRC

Position: GRC Specialist / Senior Analyst – Governance, Risk & Compliance

Experience: 6 Years

Industry: Insurance (Life/General/Health)/BFSI

Role Overview

We are seeking an experienced IT Risk & Cybersecurity GRC professional (6+ years) to oversee our governance, internal audit readiness, regulatory compliance posture and user access review framework within a regulated insurance environment.

The role will play a critical part in managing internal audits, IRDAI/CERT-IN compliance, user access governance, third-party risk, control testing and executive risk reporting.

The ideal candidate must have hands-on experience as both:

An auditee for regulatory and internal audits
A control assessor / reviewer conducting independent internal reviews

Key Responsibilities

Risk & Control Governance

Strong understanding of IT Risk Management lifecycle (Integrated Risk Management, Risk and Control Self-Assessment, Information Risk Assessment, Business Impact Assessment)
Perform risk assessments and control testing across IT and cybersecurity domains
Identify control gaps and design new controls aligned with evolving threat landscape
Track and ensure timely closure of audit observations and risk issues
Maintain risk registers and document risk acceptance where applicable
Coordinate security incident reporting, root cause analysis and remediation tracking.

Internal & Regulatory Audit Management

Act as primary auditee for:
IRDAI Cyber Security Audits
CERT-IN compliance
Internal audits (including Big 4)
Financial & ITGC audits
Coordinate evidence submission and stakeholder responses
Conduct internal mock audits to assess control effectiveness
Ensure 100% closure of audit issues within agreed timelines
Track remediation and report to senior leadership

User Access Governance

Deep understanding of:
Privileged Access Reviews
Normal User Access Reviews
Role-based access control (RBAC)
Segregation of Duties (SoD)
Joiner-Mover-Leaver (JML) process
Conduct periodic UAR across applications and infrastructure
Validate access appropriateness and least privilege principles
Coordinate with business owners and application teams for certifications
Review PAM controls and session monitoring
Publish interim and final access review reports

Third Party Risk Management

Conduct third-party risk assessments during onboarding in accordance to the organization's risk tolerance
Perform annual continuous risk reassessment
Evaluate vendor BCP/DR capabilities
Ensure contractual security clauses are aligned with regulatory expectations
Track vendor remediation actions

KPI / KRI / KCI Management

Define and track security KPIs, KRIs and KCIs
Develop risk dashboards for senior management and governance forums
Present risk posture updates to leadership

Regulatory Compliance (Insurance Sector)

Interpret and implement circulars from:
IRDAI
CERT-IN
Other applicable regulators
Translate regulatory expectations into actionable control implementations
Conduct gap assessments against regulatory mandates especially the DPDP act
Drive remediation programs

Policy & Framework Management

Review and update ISMS and BCMS policies and procedures
Align with ISO 27001, internal group standards and regulatory requirements
Drive policy modernization initiatives
Coordinate with cross-functional teams to ensure policy adoption and compliance.

Business Continuity & DR

Support Business Continuity Planning (BCP) and Disaster Recovery (DR) compliance requirements.
Participate in DR drills and ensure documentation readiness.
Creating and analyzing weighted, risk-based matrix to categorize applications based on their business and information security criticality.

GRC Platforms & Reporting

Hands-on experience with GRC tools such as:
IBM OpenPages (preferred)
Archer / MetricStream / equivalent
Maintain risk registers and issue trackers
Generate dashboards and executive reports

Security Awareness & Training

Design and rollout training programs in accordance to the evolving threat landscape
Support awareness initiatives to uplift control maturity

Mandatory Skills & Experience

6+ years in IT Risk / Cybersecurity GRC (BFSI/Insurance preferred)
Strong audit handling experience (IRDAI exposure highly preferred)
Demonstrated experience in User Access Reviews (non-negotiable)
Experience with PAM, access governance and audit evidence validation
Good understanding of IT infrastructure, cybersecurity concepts and vendor risk processes.
Strong communication, documentation & reporting skills
Exposure to senior governance forums
Ability to independently drive remediation
Analytical thinking and problem-solving.
Attention to detail and ability to handle multiple compliance workstreams.

Preferred Qualifications

Bachelor's degree in IT, Computer Science, Engineering, or related field.
ISO 27001 Lead Implementer / Auditor
CISA / CRISC / CISSP (added advantage)
Experience in regulated insurance environment

What We Are Looking For

A hands-on, detail-oriented, audit-mature GRC professional who:

Can independently manage regulatory interactions
Understands risk deeply (not checklist-based)
Has strong user access governance expertise
Can present confidently to senior leadership
Can drive closure without supervision