GRC and Vendor Risk Management
BengaluruFull-timeHybrid2–5 yrsPosted 1 week ago
Mid-level risk and compliance role at Whatfix in Bengaluru. Needs 2+ years. Hybrid.
About the role
We are looking for an Information Security – GRC Engineer to support and drive Whatfix's multi-framework compliance program across Information Security, Data Privacy, AI Governance, and Third-Party Risk Management (TPRM).
What you'll do
- Conduct and coordinate third-party information security, privacy, compliance, and AI risk assessments
- Review vendor-provided evidence and artefacts, including security questionnaires, certifications, audit reports, policies, and other assurance documentation
- Identify, assess, document, and track risks associated with third-party relationships and follow up on mitigation and remediation actions
- Maintain accurate vendor inventories, assessment records, risk ratings, findings, exceptions, and reassessment schedules
- Manage and continuously monitor the vendor/TPRM management platform and related trackers to ensure records remain complete and up to date
What you need
- Risk management
- ISO 27001
- Compliance
- Data privacy
- Due diligence
- SOP writing
Good to have
- KYC
- LLMs