Experience : 7 to 10 Years.

Role : Cybersecurity GRC & Risk Specialist.

Location : Bengaluru.

Work Mode : On-site.

Job Description :

Key Responsibilities :

- Policy Governance : Maintain, review, and evolve enterprise cybersecurity policies, procedures, and baseline standards.

- Risk Management : Conduct rigorous cybersecurity risk assessments and maintain a comprehensive, dynamic enterprise cyber-risk register.

- Metrics & Reporting : Define, track, and monitor critical cybersecurity Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs).

- Control Mapping : Map internal security controls against leading frameworks such as NIST CSF, ISO 27001, CIS Controls, and applicable financial regulatory requirements.

- Audit Coordination : Facilitate and coordinate internal and external cybersecurity audits and compliance evaluations.

- Third-Party Risk : Conduct third-party and vendor cybersecurity risk assessments to evaluate supply-chain posture and vendor resilience.

- Exception Management : Manage security exceptions, risk acceptances, and compensating controls workflows.

- Assurance & Testing : Establish structured control-testing methodologies and track control deficiencies to complete remediation.

- Executive Dashboards : Prepare high-impact dashboards and metrics packages for senior management and Board-level reporting.

- Resilience & Continuity : Support business continuity, cyber-resilience planning, and regulatory readiness assessments.

- Governance Forums : Coordinate and drive cybersecurity governance committees and operational forums.

- Incident Governance : Support incident governance workflows and contribute to post-incident risk reviews.

- Integrated Risk : Seamlessly integrate IT, OT, and cloud risk profiles into broader enterprise risk management frameworks.

Required Skills & Experience :

- Experience : 7 to 12 years of specialized professional experience in cybersecurity Governance, Risk, and Compliance (GRC), risk management, or information security auditing.

- Framework Mastery : Deep, working knowledge of major security frameworks, specifically NIST CSF and ISO 27001.

- Core Competencies : Proven expertise in cyber risk assessment methodologies, regulatory compliance audits, and third-party vendor risk management.

- Metrics & Analysis : Demonstrated ability to build and monitor meaningful KPI/KRI reporting frameworks.

- Domain Context : Preferred familiarity with manufacturing or OT environments, alongside a solid grasp of financial services risk landscapes.

- Communication : Outstanding English communication skills (both verbal and written), with a polished capability to translate complex technical risks into clear executive language.

Preferred Certifications :

- CISSP (Certified Information Systems Security Professional).

- CISA (Certified Information Systems Auditor).

- CRISC (Certified in Risk and Information Systems Control).

- ISO 27001 Lead Auditor / Lead Implementer.

- Or equivalent governance and risk certifications.

Expected Deliverables & Outcomes :

- A centralized, up-to-date enterprise cyber-risk register.

- A robust, well-mapped cybersecurity control framework.

- Comprehensive quarterly risk and performance dashboards for senior leadership.

- An established audit-readiness and continuous assurance program.

- Scalable third-party risk assessment reports and vendor scoring matrices.

- Formalized policy, standard operating procedure, and governance frameworks.