Cyber Security GRC & Risk Specialist
First seen by Alion on Nov 13, 2026.
Experience : 7 to 10 Years.
Role : Cybersecurity GRC & Risk Specialist.
Location : Bengaluru.
Work Mode : On-site.
Job Description :
Key Responsibilities :
- Policy Governance : Maintain, review, and evolve enterprise cybersecurity policies, procedures, and baseline standards.
- Risk Management : Conduct rigorous cybersecurity risk assessments and maintain a comprehensive, dynamic enterprise cyber-risk register.
- Metrics & Reporting : Define, track, and monitor critical cybersecurity Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs).
- Control Mapping : Map internal security controls against leading frameworks such as NIST CSF, ISO 27001, CIS Controls, and applicable financial regulatory requirements.
- Audit Coordination : Facilitate and coordinate internal and external cybersecurity audits and compliance evaluations.
- Third-Party Risk : Conduct third-party and vendor cybersecurity risk assessments to evaluate supply-chain posture and vendor resilience.
- Exception Management : Manage security exceptions, risk acceptances, and compensating controls workflows.
- Assurance & Testing : Establish structured control-testing methodologies and track control deficiencies to complete remediation.
- Executive Dashboards : Prepare high-impact dashboards and metrics packages for senior management and Board-level reporting.
- Resilience & Continuity : Support business continuity, cyber-resilience planning, and regulatory readiness assessments.
- Governance Forums : Coordinate and drive cybersecurity governance committees and operational forums.
- Incident Governance : Support incident governance workflows and contribute to post-incident risk reviews.
- Integrated Risk : Seamlessly integrate IT, OT, and cloud risk profiles into broader enterprise risk management frameworks.
Required Skills & Experience :
- Experience : 7 to 12 years of specialized professional experience in cybersecurity Governance, Risk, and Compliance (GRC), risk management, or information security auditing.
- Framework Mastery : Deep, working knowledge of major security frameworks, specifically NIST CSF and ISO 27001.
- Core Competencies : Proven expertise in cyber risk assessment methodologies, regulatory compliance audits, and third-party vendor risk management.
- Metrics & Analysis : Demonstrated ability to build and monitor meaningful KPI/KRI reporting frameworks.
- Domain Context : Preferred familiarity with manufacturing or OT environments, alongside a solid grasp of financial services risk landscapes.
- Communication : Outstanding English communication skills (both verbal and written), with a polished capability to translate complex technical risks into clear executive language.
Preferred Certifications :
- CISSP (Certified Information Systems Security Professional).
- CISA (Certified Information Systems Auditor).
- CRISC (Certified in Risk and Information Systems Control).
- ISO 27001 Lead Auditor / Lead Implementer.
- Or equivalent governance and risk certifications.
Expected Deliverables & Outcomes :
- A centralized, up-to-date enterprise cyber-risk register.
- A robust, well-mapped cybersecurity control framework.
- Comprehensive quarterly risk and performance dashboards for senior leadership.
- An established audit-readiness and continuous assurance program.
- Scalable third-party risk assessment reports and vendor scoring matrices.
- Formalized policy, standard operating procedure, and governance frameworks.
Skills
Security, Cyber Security, GRC, GRC Tools, IT Risk, Cyber Risk Management, NIST, ISO, CISSP, CISA