Job Details

Job Description:

Role Summary

The Senior / Principal GRC Analyst is a senior individual contributor responsible for architecting, leading, and scaling enterprise governance, risk, and compliance programs across highly regulated, technologydriven environments. This role owns implementation and continuous improvement of ISO/IEC 27001, ISO/IEC 42001 (AI Management Systems), GDPR, CCPA/CPRA, and CMMC, and acts as a trusted advisor to security leadership, engineering, legal, and executive stakeholders.

This role requires strong handson cybersecurity knowledge, deep regulatory expertise, and the ability to translate technical security architectures into auditready, businessaligned compliance outcomes.

Core Responsibilities (All Environments)

Define and maintain a riskbased GRC architecture aligned to ISO, NIST, privacy, and regulatory requirements.
Lead endtoend implementations of:

ISO/IEC 27001 (ISMS ownership, risk methodology, SoA, internal audits)
ISO/IEC 42001 (AI governance, AI risk and control design)
GDPR and CCPA/CPRA privacy programs
CMMC / NIST SP 800171

Translate security architectures and technical controls into compliant policies, standards, and evidence.
Lead enterprise, thirdparty, cloud, and AIspecific risk assessments.
Serve as primary interface for auditors, assessors, regulators, customers, and partners.
Drive efficiency using GRC platforms, security telemetry, and AIassisted compliance tooling.
Mentor junior GRC professionals and influence crossfunctional teams without direct authority.

Technical Cybersecurity Skills & Expectations

Security Architecture & Controls

Strong understanding of defenseindepth architectures, including:

Network segmentation, firewalls, IDS/IPS
Endpoint Detection & Response (EDR/XDR)
Identity and Access Management (IAM), SSO, MFA, RBAC

Ability to assess and validate technical control effectiveness, not just paper compliance.

Cloud & SaaS Security

Handson familiarity with cloud security models (AWS, Azure, GCP concepts):

Shared responsibility
Logging and monitoring
Encryption at rest and in transit
Secure CI/CD and infrastructureascode risks

Ability to map cloud security controls to ISO 27001, NIST, and CMMC requirements.

Data Protection & Privacy Engineering

Understanding of:

Data classification and labeling
DLP, encryption, key management
Data residency and crossborder data transfer controls

Ability to work with engineering teams on privacybydesign implementations.

Vulnerability & Risk Management

Familiarity with:

Vulnerability management lifecycle
Secure configuration baselines
Risk acceptance, compensating controls, and technical debt

Ability to assess realworld risk rather than checklist compliance.

Incident Response & Monitoring

Knowledge of incident response processes, including:

Detection, containment, and postincident reviews
Regulatory and contractual notification requirements

Ability to validate IR plans against ISO and regulatory expectations.

AI & Emerging Technology Risk

Understanding of AIrelated security and governance risks:

Training data integrity
Model lifecycle and access control
Bias, explainability, and accountability considerations

Exposure to AIenabled security and compliance tools preferred.

IndustrySpecific Skills

Defense / Government Contractors

CMMC L1–L3 and NIST SP 800171 technical control interpretation
CUI protection, enclave design, boundary controls
Vendor and subcontractor security assurance
DFARSaligned audit and evidence readiness

Semiconductor / Hardware & Manufacturing

Protection of design IP, fabrication data, and production systems
Supplier and foundry security risk assessments
Alignment of cyber, physical, and operational security controls
Global compliance and data localization considerations

SaaS / CloudNative

Cloudnative ISMS design
Secure SDLC and CI/CD risk governance
Customer audits, security questionnaires, trust signals
AI feature governance and responsible data usage

Qualifications

Required Qualifications

7–12+ years of experience in GRC, security, privacy, or risk management.
Proven ownership of ISO 27001, GDPR/CCPA, and CMMC or NIST 800171 programs.
Strong technical and regulatory interpretation skills.
Ability to operate independently at senior or principal IC level.

Preferred Certifications & Experience

ISO 27001 Lead Implementer / Lead Auditor
CISSP, CISA, CRISC
CIPM, CIPP/US, CIPP/E
Experience with Microsoft security and compliance platforms (Purview, Defender, Entra ID) or equivalent
Exposure to AI governance frameworks, tools, or regulations

Role Leveling Expectations

Senior GRC Analyst

Leads major compliance initiatives
Acts as SME for key frameworks
Partners closely with security and engineering
Defines enterprise GRC strategy and architecture
Advises executives on material cyber and regulatory risk
Shapes AI governance and future compliance roadmaps
Mentors and raises overall GRC maturity

Job Type

Regular

Shift

Primary Location:

Bengaluru, Karnataka, India

Additional Locations:

Posting Statement

All qualified applicants will receive consideration for employment without regard to race, color, religion, religious creed, sex, national origin, ancestry, age, physical or mental disability, medical condition, genetic information, military and veteran status, marital status, pregnancy, gender, gender expression, gender identity, sexual orientation, or any other characteristic protected by local law, regulation, or ordinance.