Infosec GRC - Analyst Role

Information Security GRC Specialist / Senior Analyst

Experience: 4 to 6 Years

Location: Navi Mumbai

Employment Type: Full-time

About the Role:

We are looking for a detail-oriented Information Security GRC Specialist with 4 to 6 years of experience to support our technical governance, risk, and compliance initiatives. In this hands-on role, you will help monitor and assess the security posture of our applications, endpoints, on-premise Data Centers (DC), and Google Cloud Platform (GCP) environments. You will work closely with IT and security teams to track vulnerabilities, review system configurations, and support ongoing IT risk assessments.

Key Responsibilities:

1. Vulnerability Assessment & Penetration Testing (VAPT) Support:

• Coordinate Internal and External VAPT activities for Applications, Networks, and core IT Infrastructure.
• Review VAPT and External Penetration Testing (PT) reports to understand technical findings.
• Work with IT and development teams to track vulnerability remediation, ensuring critical issues are patched within agreed timelines.

2. Endpoint & Systems Security Review:

• Conduct routine reviews of Endpoint Security controls, including Patch Management and Anti-Virus (AV) Management compliance.
• Perform baseline Operating System (OS) Reviews and regular Inventory Reviews to ensure adherence to corporate security policies.
• Assist in auditing Endpoint Central configurations and managing the security review process for 3rd Party Software.

3. Infrastructure & Cloud Security (On-Premise & GCP):

• Assist in conducting security configuration reviews for On-Premise Data Centers (DC) and critical Databases (DB).
• Perform foundational Cloud Configuration Reviews for Google Cloud Platform (GCP) to ensure access controls and security settings meet industry best practices.
• Identify and report misconfigurations in both cloud and on-premise infrastructure.

4. Risk Assessment & Gap Analysis:

• Participate in and support IT Gap Risk Assessments across systems and applications.
• Document identified security gaps and assist in updating the organization’s Risk Register.
• Follow up with relevant stakeholders to track the progress of risk mitigation and remediation action plans.

Required Skills & Qualifications:

• Experience: 4 to 6 years of hands-on experience in Information Security, IT Audit, Vulnerability Management, or Technical GRC.
• Technical Acumen: Ability to read and understand technical VAPT reports and grasp basic networking, infrastructure, and application security concepts.
• Endpoint & Systems: Practical experience reviewing AV logs, patch compliance reports, and software inventories.
• Cloud & Infra Knowledge: Familiarity with basic cloud security concepts (specifically GCP) and traditional Data Center/Database security foundations.
• Frameworks: Basic understanding of security standards (e.g., ISO 27001, CIS Controls).
• Communication: Strong documentation skills and the ability to communicate technical security issues clearly to IT administrators and developers.

Preferred Certifications (Good to Have):

• CISA (Certified Information Systems Auditor) – or working towards it
• CEH (Certified Ethical Hacker) or CompTIA Security+
• ISO 27001 Lead Auditor / Implementer
• Cloud security certifications (e.g., Google Cloud Digital Leader or Associate Cloud Engineer)

Pay: ₹1,000,000.00 - ₹1,200,000.00 per year

Work Location: In person