Senior GRC Specialist

Company: Reward360 Global Services Private Limited Location: Bengaluru, India Work From Office Department: Information Security / Technology Operations Experience Level: 03 to 04 Years Position Overview Reward360 is seeking an experienced, analytical, and highly structured Senior GRC Specialist to oversee our IT Governance, Risk, and Compliance frameworks.

In this role, you will be the core custodian of our compliance posture, ensuring our highvolume, enterprise-grade rewards platforms align with global security frameworks like ISO 27001, ISO 27701, PCI-DSS Implementation, ISO 42001, Internal DPIA and SOC 2 , as well as data privacy mandates. You will manage internal and external audits, mitigate technology risks, and evaluate the compliance profiles of third-party vendors.

Key Responsibilities

Support the continuous design, implementation, and assessment of internal controls aligned with ISO 27001:2022, SOC 2 Type II , and the NIST Cybersecurity Framework (CSF) . Audit Readiness & Management: Act as the primary interface for external auditors and client assessment teams. Manage end-to-end evidence collection, control validation, and the swift remediation of any audit findings.

Risk & Vulnerability Governance: Coordinate regular IT and security risk assessments across departments. Main and update the corporate Risk Register, ensuring technical risks are effectively communicated and tracked. Third-Party Risk Management (TPRM): Evaluate vendor risk postures, conduct due diligence on SaaS partners, cloud infrastructure providers, and merchant integrations, and ensure client trust is maintained Data Privacy & Regulations: Partner with legal and security teams to monitor compliance with regional data protection mandates, including India’s DPDP Act, GDPR , and global privacy regulations.

GRC Automation: Drive efficiencies by implementing or optimizing modern GRC tools to automate evidence collection, user access control tracking, and risk analytics.

Required Skills

& Qualifications Experience: 03 to 04 years of dedicated experience working in Information Security GRC, IT audit, or customer assurance teams. Experience within fintech, e-commerce, or enterprise loyalty platforms is preferred. Core Standards: Demonstrated working knowledge and hands-on implementation tracking of ISO 27001, ISO 42001, ISO 27701, PCI-DSS and SOC 2 standards.

Execution Blueprint: Proven track record working in an SLA-driven environment where precision, accurate reporting, and high organisational capabilities are essential. Privacy Acumen: Clear understanding of data handling compliance, customer privacy laws, and identity-access validation requirements. Communication: Strong written and verbal English communication skills, with the professional presence needed to comfortably interact with senior internal stakeholders and enterprise clients.

Certifications (Preferred): Professional credentials such as CISA, CRISC, CISM, or ISO Lead Auditor are highly advantageous