Senior Security GRC Analyst_Gurgaon

Senior Security GRC Analyst

Experience: 4-6 years

Industry: Fintech (Payments, Cards, Lending, UPI)

About Us

We are a fast-growing AI-first fintech platform enabling banks, NBFCs, and financial institutions to launch and scale next-generation credit products, including credit cards, credit lines, lending, and payment solutions. Our platforms process high-volume financial transactions and power business-critical customer journeys where reliability, performance, and security are non-negotiable.

We are looking for a Senior Security GRC Analyst who thrives in high-ownership environments, enjoys solving complex engineering challenges, and is passionate about building products that directly impact millions of users and financial institutions.

Role Overview

We are looking for a hands-on Security GRC professional to own our information security governance, risk, and compliance programs. You will work closely with Engineering, Product, Risk, and Internal Audit teams to ensure regulatory and security compliance across our card, wallet, and UPI platforms.

Key Responsibilities

• ISMS & Standards: Maintain, monitor, and improve the ISO 27001 Information Security Management System, including risk registers, SOA, policies, and control evidence.
• PCI DSS Compliance: Support PCI DSS compliance for the credit card platform, including HSM-based protection of PIN data (PCI PTS HSM), scope reduction, and audit readiness.
• SOC 2 Type 2: Support the implementation and audit of SOC 2 Type 2 controls.
• CERT-IN / SAR DLA: Manage and coordinate SAR (System Audit Report) and DLA (Data Localisation Audit) compliance with CERT-IN empaneled auditors.
• Regulatory Tracking: Monitor RBI, NPCI, and other applicable regulations; translate requirements into internal controls and roadmaps.
• Risk Management: Conduct risk assessments, control gap analysis, and treatment tracking across the organization.
• Audits & Assessments: Coordinate internal and external audits, including ISO 27001, PCI DSS, SOC 2, and regulatory audits; track remediation and closure.
• Policy & Process: Develop, review, and maintain security policies, standards, procedures, and guidelines.
• Vendor Risk: Perform security assessments of third-party vendors and partners.
• Security Awareness: Drive security awareness, training, and phishing simulation programs.
• Reporting: Prepare dashboards and reports for leadership, auditors, and regulators.

Required Qualifications

• 4-5 years of experience in Information Security Governance, Risk, and Compliance within BFSI, fintech, or payments.
• Hands-on experience with ISO 27001, SOC 2, and PCI DSS compliance.
• Knowledge of RBI and NPCI guidelines relevant to payments, wallets, and card platforms.
• Experience with risk assessments, control frameworks, and audit management.
• Strong understanding of HSM concepts and key management for PCI DSS.
• Excellent communication, documentation, and stakeholder management skills.
• Relevant certifications such as CISA, CISM,CRISC, CGRC,ISO 27001 LA/LI are preferred.

Good-to-Have

• Knowledge of the Digital Personal Data Protection (DPDP) Act 2023.
• Exposure to AI security and AI governance frameworks.
• PCI QSA / ISA or similar audit credentials.
• Experience working in cloud environments (AWS, Azure, GCP).

What You Will Work On

• Securing and governing a regulated payments ecosystem spanning credit cards, prepaid cards, wallets, and UPI credit lines.
• Driving compliance maturity across ISO 27001, SOC 2 Type 2, PCI DSS, and CERT-IN requirements.
• Building a scalable GRC function that aligns with RBI and NPCI expectations.