Information Technology Risk Management L2 Support & GRC Analyst

ITRM L2 Support & GRC Analyst

Job Title: IT Risk Management Analyst L2 Support

Department: Information Security / IT Governance

Location: Noida Sector 125

Experience: 5- 10 years

Employment Type: Full-Time

Required - Immedaite Joiner

1. Role Overview The IT Risk Management L2 Support & GRC Analyst will be responsible for supporting IT risk processes, regulatory compliance reporting, governance activities, technical risk assessments, internal/external audit support, and cybersecurity governance functions.

The role involves hands-on experience in risk analysis, compliance monitoring, evidence collection, report writing, VAPT interpretation, and mapping controls to frameworks such as RBI, CERT-In, UIDAI, NSDL, and HIPAA.

2. Key Responsibilities

A. IT Risk Management & Governance

Conduct technology risk assessments, gap analysis, and risk scoring across IT systems, applications, infrastructure, and vendor environments.

Assist in the development and maintenance of Risk Registers, Issue Trackers, and Corrective Action Plans.

Perform RCSA (Risk Control Self-Assessment) activities, including identification of key risks, controls, and mitigation actions.

Support IT risk governance meetings by preparing dashboards, status reports, and risk metrics.

B. GRC (Governance, Risk & Compliance) Operations

Manage and update controls within GRC platforms (Archer, ServiceNow GRC, Metric Streamor internal equivalents).

Map controls to frameworks such as, COBIT, HIPAA, PCI DSS (as applicable).

Monitor control performance and support periodic control testing.

Perform policy compliance assessments and track deviations/exceptions.

C. Regulatory Reporting & Compliance (RBI, IRDAI, CERT-In, NSDL, UIDAI)

Prepare and submit periodic regulatory reports such as:

RBI Cyber Security Incident Reporting, System Audit, Cyber Drill Compliance

IRDAI Cyber Security Guidelines Compliance & Audit Inputs

CERT-In Incident Reporting & Monthly/Quarterly Submissions

UIDAI Security Audits & Compliance Reports

NSDL/CRA guidelines compliance

Liaise with internal stakeholders for gathering evidence and validating data for regulatory submissions.

Track changes in regulatory requirements and ensure timely implementation in processes.

D. Audit Support (Internal, External, Statutory)

Coordinate with IT, Infosec, and internal & external auditors for audits such as:

CSITE, Statutory

RBI/IRDAI/CERT-In mandated audits

Internal IT & Cybersecurity audits

Vendor security assessments

Collect, verify, and organize audit evidence as per auditor expectations.

Maintain audit trail, evidence repository, and noncompliance trackers.

Map audit findings to risk categories and track closure of observations.

E. Technical Skills VAPT Understanding & Security Concepts

Understand VAPT reports, identify technical vulnerabilities, and map them to risk impact.

Work with SOC/Infra/Application teams for remediation tracking and evidence validation.

Support patch management, vulnerability closure, and secure configuration initiatives.

Understand common security domains: network security, application security, cloud controls, identity access management.

F. Documentation & Report Writing

Prepare high-quality risk reports, regulatory submissions, audit reports, and management dashboards.

Draft Standard Operating Procedures (SOPs), compliance summaries, and policy updates.

Document process gaps, risks, and required controls in a clear and structured manner.

3. Required Skills & Competencies

Technical & Functional Skills

Strong understanding of:

RBI Cyber Security Framework & Baseline Controls

CERT-In 2022 Guidelines

HIPAA Security Rule (if applicable)

Good knowledge of Vulnerability Assessment & Penetration Testing (VAPT) cycles.

Experience in audit evidence management, documentation control, and compliance reporting.

Ability to think analytically to identify and assess technology risks.

Soft Skills

Excellent written communication (strong report-writing ability).

Good stakeholder coordination across IT, Security, Operations, and Audit.

Ability to work independently and in fast-paced regulatory environments.

Problem-solving mindset, attention to detail, and structured thinking.

4. Educational Qualifications

Bachelors degree in computer science, IT, Electronics, Cyber Security, or related field.

Preferred Certifications (any one or more):

CEH / Security+ / CCSP (optional)

NIST CSF Foundation

ITIL (for L2 support/gov processes)

CRISC / CISA (added advantage)

5. Key Performance Indicators (KPIs)

Timely submission of regulatory reports.

Reduction in open audit findings.

Closure timelines for vulnerabilities & risks.

Accuracy and completeness of documentation.

Compliance score improvement (RBI frameworks).

Efficiency in RCSA completion & control testing .