{"id":1949647,"url":"https://alion.io/job/ai-ag-lead-security-grc-analyst","title":"Lead Security GRC Analyst","company":{"id":2123061,"name":"Falcon","domain":"falconfs.com","url":"https://alion.io/company/falconfs","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Keka","truth_index":{"grade":"D","score":46,"open_postings":10,"ghost_share":0.9,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":null,"computed_at":"2026-10-21T05:46:15Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Gurgaon, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":3500000,"max":4500000,"currency":"INR","period":"year","gross":null,"usd_annual":46454},"salary_estimate":null,"experience_years_min":7,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"ISO 27001","optional":false},{"name":"PCI DSS","optional":false},{"name":"SOC 2","optional":false},{"name":"AWS","optional":true},{"name":"Azure","optional":true},{"name":"GCP","optional":true}],"status":"live","first_seen_at":"2026-10-06T07:20:15Z","employer_posted_date":"2026-10-06","last_verified_at":"2026-10-21T06:37:23Z","board_verified":true,"closed_at":null,"days_open":15,"trust":{"level":"ok","repost_count":0,"flags":["company_stale"],"days_open":14},"description":"Who are we? \nWe are a fast-growing AI-first fintech platform enabling banks, NBFCs, and financial institutions to launch and scale next-generation credit products, including credit cards, credit lines, lending, and payment solutions. Our platforms process high-volume financial transactions and power business-critical customer journeys where reliability, performance, and security are non-negotiable.\nWe are looking for a Lead Security GRC Analyst who thrives in high-ownership environments, enjoys solving complex engineering challenges, and is passionate about building products that directly impact millions of users and financial institutions.\n For more details, please visit https://falconfs.com/\nJob Summary:\nWe are looking for an experienced Security GRC leader to own and scale our information security governance, risk, and compliance function. Reporting to the Security Architect, you will set the GRC strategy and roadmap, lead audits and regulatory engagements end-to-end, and manage a team of 1-2 GRC Analysts. This role is central to our position as a card issuer and issuer-processor, so a strong grounding in PCI DSS from the issuing side - and hands-on experience within the Indian fintech and payments ecosystem - is essential. You will partner closely with Engineering, Product, Risk, Internal Audit, and senior leadership to drive security and regulatory compliance across our card, wallet, and UPI platforms, mentor and develop your team, and represent the security program to leadership, auditors, and regulators.\nKey Responsibilities:\nGRC Strategy & Program Ownership: Define, own, and continuously mature the organization's security GRC strategy, roadmap, and operating model, aligned with business objectives and the regulatory landscape.\nTeam Leadership: Manage, mentor, and develop a team of 1-2 GRC Analysts; establish standards, playbooks, and ways of working; and build a scalable, repeatable GRC function.\n PCI DSS Compliance (Issuer / Issuer-Processor): Own and lead PCI DSS compliance from the card issuer and issuer-processor perspective - protecting cardholder data (PAN) and PIN data across the issuance and processing flows, including HSM-based key management (PCI PTS HSM), CDE scope definition and reduction, and end-to-end audit readiness. (This role is focused on the issuing side, not the merchant/acquirer or payment-application / PA-DSS perspective.)\nISMS & Standards: Own and continually improve the ISO 27001 Information Security Management System, including risk registers, SOA, policies, and control evidence; drive management reviews and continual-improvement cycles.\nSOC 2 Type 2: Own the implementation, operation, and audit of SOC 2 Type 2 controls.\n CERT-IN / SAR / DLA: Lead and own SAR (System Audit Report) and DLA (Data Localisation Audit) compliance, managing relationships with CERT-IN empanelled auditors.\nRegulatory Engagement: Monitor RBI, NPCI, and other applicable regulations; translate requirements into internal controls and roadmaps; and serve as a key liaison for regulatory and partner-bank engagements.\nRisk Management: Own the enterprise information security risk program - risk assessments, control gap analysis, risk treatment, and reporting of residual risk to leadership.\nAudits & Assessments: Lead internal and external audits end-to-end, including ISO 27001, PCI DSS, SOC 2, and regulatory audits; drive remediation, track closure, and act as the primary escalation point.\nPolicy & Process: Own the security policy framework - develop, review, approve, and maintain security policies, standards, procedures, and guidelines.\nVendor Risk: Own the third-party/vendor risk management program and lead security assessments of vendors and partners.\nSecurity Awareness: Own and drive security awareness, training, and phishing simulation programs across the organization.\nReporting & Governance: Prepare and present dashboards and reports for leadership, the board, auditors, and regulators; drive governance forums and risk committees.\nRequired Qualifications:\n7-10 years of experience in Information Security Governance, Risk, and Compliance, with mandatory, hands-on experience in the Indian fintech / payments ecosystem (RBI/NPCI-regulated card, wallet, or UPI businesses), including experience leading GRC programs and/or teams.\nHands-on PCI DSS experience from the card issuer / issuer-processor side - securing PAN and PIN data across issuance and processing - as opposed to a purely merchant/acquirer or payment-application (PA-DSS) background.\nHands-on, in-depth experience with ISO 27001 and SOC 2 compliance.\nStrong, practical knowledge of RBI and NPCI guidelines relevant to payments, wallets, and card platforms.\nProven experience owning and managing audits end-to-end across risk assessments, control frameworks, and remediation.\nStrong understanding of HSM concepts and key management for PCI DSS in an issuing environment.\nDemonstrated ability to lead and mentor analysts and influence cross-functional and senior stakeholders.\nExcellent communication, documentation, and executive stakeholder management skills.\nRelevant certifications such as CISA, CISM, CRISC, CGRC, ISO 27001 LA/LI are preferred.\nGood-to-Have:\nWorking knowledge of the Digital Personal Data Protection (DPDP) Act 2023.\nExposure to AI security and AI governance frameworks.\nPCI QSA / ISA or similar audit credentials.\nExperience working in cloud environments (AWS, Azure, GCP).\nWhat You Will Work On:\nSecuring and governing a regulated payments ecosystem spanning credit cards, prepaid cards, wallets, and UPI credit lines - from a card issuer and issuer-processor standpoint.\nDriving and owning compliance maturity across ISO 27001, SOC 2 Type 2, PCI DSS (issuing side), and CERT-IN requirements.\nBuilding and leading a scalable GRC function and team that aligns with RBI and NPCI expectations.","description_format":"text","description_chars":5853,"description_truncated":false,"requirements":{"experience_years_min":7,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Financial Software & Embedded Finance","Digital Banks & Neobanks"],"lifecycle":[{"event":"open","at":"2026-10-06T09:01:40Z"}],"visa":[],"liveness":{"score":51,"band":"ok","label":"Likely open","p_open":1,"p_active":0.571,"p_room":0.9,"age_days":14,"expected_fill_days":26,"reasons":["conf:2","stale_co","win:mid"],"computed_at":"2026-10-21T05:46:15Z"},"pay":{"stated_usd_annual":46454,"is_top_pay":false},"html_url":"https://alion.io/job/ai-ag-lead-security-grc-analyst","json_url":"https://alion.io/job/ai-ag-lead-security-grc-analyst.json","meta":{"generated_at":"2026-10-21T08:08:50Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":11577,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-22T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2123061},"rest":"https://alion.io/mcp/rest/get_company?id=2123061"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fai-ag-lead-security-grc-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fai-ag-lead-security-grc-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fai-ag-lead-security-grc-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/ai-ag-lead-security-grc-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fai-ag-lead-security-grc-analyst"}]}