Work here. Find the dream job you've always wanted.
Support implementation and maintenance of the organization's GRC framework. Identify, assess, document, and monitor information security and operational risks. Maintain risk registers and track risk treatment plans. Conduct periodic risk assessments and support risk mitigation activities. Perform Risk & Control Self-Assessments (RCSA) with business and technical teams. Monitor compliance with internal policies, procedures, standards, and regulatory requirements. Identify and support closure of governance and compliance gaps.
Support implementation and maintenance of the organization's GRC framework.
Identify, assess, document, and monitor information security and operational risks.
Maintain risk registers and track risk treatment plans.
Conduct periodic risk assessments and support risk mitigation activities.
Perform Risk & Control Self-Assessments (RCSA) with business and technical teams.
Monitor compliance with internal policies, procedures, standards, and regulatory requirements.
Identify and support closure of governance and compliance gaps.
Conduct information security and IT risk assessments.
Identify risks related to processes, systems, applications, vendors, and business operations.
Evaluate risk likelihood, impact, and overall risk ratings.
Recommend appropriate controls and mitigation actions.
Track risk acceptance, mitigation, transfer, and avoidance activities.
Ensure timely closure of risk treatment actions.
Prepare periodic risk status reports and dashboards for management.
Support assessments against ISO 27001/27002, SOC 2, ITGC, and applicable regulatory requirements.
Review existing controls and evaluate their effectiveness.
Conduct control testing and gap assessments.
Identify control deficiencies and recommend corrective actions.
Monitor remediation plans and validate closure of identified gaps.
Maintain evidence demonstrating compliance.
Plan and coordinate internal and compliance audits.
Support external certification, surveillance, customer, and regulatory audits.
Coordinate with process owners for audit evidence collection.
Review evidence for completeness, accuracy, and adequacy.
Track audit findings, observations, corrective actions, and closure status.
Support root-cause analysis and corrective action planning.
Maintain audit documentation and evidence repositories.
Support implementation and maintenance of ISO 27001 ISMS requirements.
Assist in maintaining information security policies, procedures, standards, and controls.
Map organizational controls against ISO 27001/27002 requirements.
Conduct periodic control reviews and gap assessments.
Support internal audits and management review activities.
Maintain ISMS documentation and audit evidence.
Track corrective and preventive actions.
Support Business Continuity Management System (BCMS) activities.
Assist with Business Impact Analysis, risk assessments, and continuity planning.
Support ISO 22301 compliance and audit activities.
Maintain business continuity documentation and evidence.
Track corrective actions from BCMS assessments and audits.
Support SOC 2 compliance and control activities.
Coordinate with control owners to collect and maintain evidence.
Assist in testing controls against applicable SOC 2 Trust Services Criteria.
Identify control gaps and coordinate remediation.
Support external auditor requirements.
Track SOC 2 observations and corrective actions.
Support assessment and testing of IT General Controls.
Review controls related to:
Access Management
User Access Reviews
Change Management
Incident Management
Backup & Recovery
IT Operations
Privileged Access
System Administration
Collect and validate evidence for ITGC testing.
Identify control weaknesses and track remediation.
Prepare ITGC assessment documentation and reports.
Assist in developing, reviewing, and updating information security policies and procedures.
Ensure policies align with applicable regulatory and industry requirements.
Maintain policy version control and approval records.
Coordinate periodic policy reviews with stakeholders.
Communicate policy requirements to relevant teams.
Track policy exceptions and deviations.
Conduct security and compliance assessments of third-party vendors.
Review vendor security questionnaires, certifications, policies, and supporting documentation.
Assess vendor risks based on business criticality and security requirements.
Maintain vendor risk assessments and risk registers.
Track remediation of vendor-related security and compliance gaps.
Support periodic vendor reviews and reassessments.
Coordinate collection of audit and compliance evidence from various departments.
Review evidence for accuracy, relevance, completeness, and validity.
Maintain structured audit evidence repositories.
Ensure evidence is available within defined timelines.
Maintain audit trails and documentation for internal and external audits.
Ensure confidentiality and appropriate access control over sensitive audit information.
Prepare periodic GRC, risk, audit, and compliance MIS reports.
Develop management dashboards and presentations using Microsoft Excel and PowerPoint.
Track compliance metrics and open audit observations.
Report overdue risks, audit actions, control gaps, and remediation status.
Present relevant risk and compliance updates to management and stakeholders.
Coordinate with Internal Audit, External Audit, Information Security, IT, HR, Finance, Operations, and other teams.
Act as a coordination point for audit and compliance activities.
Respond to auditor requests and ensure timely evidence submission.
Follow up with control owners on pending actions and documentation.
Communicate compliance requirements clearly to stakeholders.
Effective implementation and maintenance of the GRC framework.
Timely completion of risk assessments and RCSA activities.
Effective control testing and gap assessments.
Successful coordination of internal, external, and compliance audits.
Accurate and timely collection of audit evidence.
Effective monitoring of ISO 27001/27002, ISO 22301, SOC 2, and ITGC controls.
Timely closure of audit observations and compliance gaps.
Effective third-party/vendor risk assessment and monitoring.
Accurate maintenance of risk registers, compliance records, and GRC documentation.
Timely and accurate GRC MIS and management reporting.
Risk Assessment Completion Rate (%)
Control Testing Completion Rate (%)
Audit Evidence Submission within Defined TAT (%)
Audit Finding / Observation Closure Rate (%)
Compliance Gap Closure Rate (%)
Policy & Procedure Review Completion (%)
Third-Party Risk Assessment Completion (%)
RCSA Completion Rate (%)
ISO / SOC / ITGC Compliance Score (%)
Accuracy and Timeliness of GRC MIS Reporting (%)
Governance, Risk & Compliance
Risk Assessment & Risk Management
Risk Register Management
Risk & Control Self-Assessment (RCSA)
Control Testing
Gap Assessment
Compliance Monitoring
Regulatory Compliance Audit
Internal & Compliance Audits
IT Audits
Audit Planning & Coordination
Audit Evidence Management
Corrective Action Tracking
Audit Finding Closure
Standards & Frameworks
ISO 27001
ISO 27002
ISO 22301
SOC 2
ITGC
Information Security Controls
Policy & Documentation
Policy Development
Procedure Development
Control Documentation
Evidence Management
Version Control
Compliance Documentation
Third-Party Risk
Vendor Risk Assessment
Third-Party Security Assessment
Vendor Due Diligence
Risk Rating & Remediation Tracking
Tools & Reporting
GRC Tools
Risk Registers
Microsoft Excel
Microsoft PowerPoint
Microsoft Word / Documentation
MIS & Compliance Reporting
The following certifications will be preferred:
ISO 27001 Lead Auditor
ISO 9001 Lead Auditor
ISO 22301 Lead Auditor