{"id":3270565,"url":"https://alion.io/job/famapp-senior-information-security-risk-analyst","title":"Senior Information Security Risk Analyst","company":{"id":2627,"name":"FamApp","domain":"famapp.in","url":"https://alion.io/company/fam","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Lever","truth_index":{"grade":"A","score":93,"open_postings":14,"ghost_share":0,"stale_share":0.071,"repost_share":0,"time_to_fill_p50_days":405,"computed_at":"2026-10-28T05:59:10Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Bengaluru, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":19500,"max_usd":42000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":11},"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"ISO 27001","optional":false},{"name":"NIST CSF","optional":false}],"status":"live","first_seen_at":"2026-10-26T11:18:31Z","employer_posted_date":"2026-10-26","last_verified_at":"2026-10-28T14:50:20Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"Role Overview\n We are seeking a proactive and detailed-oriented IT Risk & Third-Party Risk Management (TPRM) Specialist to join our team. In this role, you will be responsible for executing cybersecurity risk assessments for our third-party vendors, suppliers, service providers and internal IT risk management processes. You will collaborate closely with IT, Engineering, Procurement, Legal, and Risk teams to identify, evaluate, and mitigate technology and vendor risks across the organization.\nMust-Haves\n Experience: 3 to 5 years of dedicated experience in IT risk management, cybersecurity, third-party risk management (TPRM), or information security governance.\n IT Risk Knowledge: Strong understanding of internal IT general controls (ITGC), access control, disaster recovery, cloud security concepts, and data protection principles.\nFramework Familiarity: Working knowledge of industry frameworks and standards, such as RBI Framework for Outsourcing of Payment and Settlement-related Activities by PSOs, RBI MD on Cyber Resilience & Digital Payment Security Controls, ISO 27001, ISO 31000, and NIST CSF.\nArtifact Evaluation: Demonstrated ability to review vendor reports, security certifications, penetration test summaries, and questionnaires.\nAnalytical & Communication Skills: Excellent analytical, organizational, and documentation skills with the ability to communicate risk findings clearly to both technical and business stakeholders.\nOwnership: Proven ability to manage multiple vendor assessments and internal risk tasks simultaneously in a fast-paced environment.\n\nGood to Haves\nProfessional certifications or active progress toward certifications such as CISA, CRISC, ISO 27001 LA/LI etc.\nPrior experience working in financial services, technology, or other regulated environments.\nHands-on experience using GRC tools or dedicated Third-Party Risk Management platforms.\nBasic awareness of AI-enabled features in GRC or risk tools\nExperience supporting IT disaster recovery exercises or business continuity planning.\n\nRoles & Responsibilities\n1. IT Risk Management\nRisk Assessment & Identification: Execute internal IT risk assessments across IT infrastructure, cloud environments, business applications, and operational workflows.\nRisk Register Maintenance: Maintain and regularly update the enterprise IT Risk Register, tracking risk treatment plans, remediation timelines, and risk acceptance approvals.\nInternal Controls Evaluation: Assess the effectiveness of internal IT controls, including access management, backup and disaster recovery, change management, and data security.\n KRI & Risk Reporting: Monitor Key Risk Indicators (KRIs) and assist in preparing periodic risk reports and metrics for management and oversight committees.\n\n2. Third-Party Cyber Risk Management (TPRM)\nVendor Risk Assessments: Perform end-to-end cybersecurity risk assessments for third-party vendors, suppliers, and external service providers.\nArtefact Review & Analysis: Review vendor security documentation, including reports, certifications, penetration testing summaries, architecture diagrams, and security policies.\nQuestionnaire Evaluation: Review and evaluate vendor responses to cybersecurity questionnaires, due diligence requests, and risk evaluations.\nRisk Quantification & Tracking: Assign vendor risk ratings, document identified gaps, establish remediation action plans, and track vendor progress on outstanding risk items.\nCross-Functional Collaboration: Work closely with Procurement, Legal, and stakeholder teams during vendor onboarding, ongoing monitoring, and contract reviews.\nIncident Monitoring & Escalation: Monitor vendor-related security incidents and advisory alerts, escalating potential issues in accordance with incident response protocols.\nWhy Join Us\n\nHigh ownership: Define and drive Fam’s IT risk posture from the ground up-shaping IT, IS & outsourcing risk frameworks.\nOrg-level impact: Influence decision-making at the highest levels, working cross-functionally with security, legal, engineering, vendors and leadership to embed a strong risk and compliance culture across the org.\nZero to one opportunity: Build scalable, audit-ready systems and processes in a fast-moving startup environment where your work directly enables product innovation and regulatory trust.\n Mission-driven: Be part of India’s first payments platform purpose-built for teenagers and young adults-balancing growth with trust, responsibility, and user safety.","description_format":"text","description_chars":4474,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cards & Card Issuing","Security Compliance","Digital Banks & Neobanks"],"lifecycle":[{"event":"open","at":"2026-10-26T11:26:37Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":1,"expected_fill_days":405,"reasons":["conf:0","velocity","win:early"],"computed_at":"2026-10-28T05:59:10Z"},"pay":null,"html_url":"https://alion.io/job/famapp-senior-information-security-risk-analyst","json_url":"https://alion.io/job/famapp-senior-information-security-risk-analyst.json","meta":{"generated_at":"2026-10-28T19:04:48Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":26104,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-29T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2627},"rest":"https://alion.io/mcp/rest/get_company?id=2627"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ffamapp-senior-information-security-risk-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ffamapp-senior-information-security-risk-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ffamapp-senior-information-security-risk-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/famapp-senior-information-security-risk-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ffamapp-senior-information-security-risk-analyst"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3270565}},{"tool":"search_jobs","arguments":{"company":"famapp.in","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3270565},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}