How to get hired
Pick your lane first. The skills overlap, but recruiters screen for the lane.
Lane 1: bank and NBFC risk
Banks and larger NBFCs must run independent risk functions under RBI rules and the Basel capital framework: credit risk (portfolio quality, provisioning, rating models), market risk (limits, VaR on the trading book), liquidity and asset-liability management, and operational risk (incident logs, risk-control self-assessments, outsourcing and fraud risk). Indian banks staff these with officers from within, MBAs from campus and some CAs. Foreign banks' Mumbai, Bengaluru and Pune centres hire "Risk Analyst" and "Associate – Credit Risk" for global portfolios. Interviews test credit fundamentals (reading a balance sheet, ratios, collateral), a little statistics (PD, LGD, EAD for credit; VaR basics for market), and how RBI's expected credit loss and capital rules work in principle.
Lane 2: Big 4 risk consulting
Big 4 firms run large "Business Consulting Risk" or "Risk Advisory" practices: internal controls, SOX, enterprise risk management frameworks, process reviews, regulatory projects for banks and insurers. They hire fresh MBAs, CAs and some B.Tech and B.Com graduates as "Analyst" or "Consultant", from campus and off-campus. The test is structured thinking: draw a risk and control matrix for a sales process, list what could go wrong in vendor onboarding. It overlaps with internal audit, and many people move between the two.
Lane 3: technology, cyber and privacy risk
IT risk, third-party risk and cyber governance roles hire engineers, BCA and MCA graduates, and auditors with IT exposure. The credentials named most are CISA (audit and control), CISM (security management) and ISO 27001 lead auditor certificates. India's Digital Personal Data Protection Act, 2023 has added privacy risk roles. If your background is technical, the cybersecurity guide and CISA guide cover those routes in more depth.
Lane 4: quantitative and model risk
Banks' global centres build and validate credit, market and fraud models, and hire postgraduates in statistics, economics, mathematics and engineering who know Python or SAS, SQL and regression. Expect a coding or statistics test and questions on model validation: back-testing, stability, why a model might fail on new data. The data analytics guide is a good companion.
Credentials
FRM from GARP (two parts) is the credential most named for bank and market risk roles; it is respected but does not replace work experience. CFA helps in investment risk. For consulting, CA or an MBA is the usual base. For cyber risk, CISA or CISM. Take one that matches your lane, not all of them.
Moving up
Analyst, Senior Analyst, Assistant Manager, Manager, Senior Manager or AVP, VP, then Head of a risk type, and eventually Chief Risk Officer in banks, NBFCs and insurers. Moves between lanes are common in the first five years and harder later.
What the work is like
Risk work is mostly calm analysis punctuated by bursts: a regulator's inspection, a fraud incident, a market shock, a board risk committee meeting each quarter. You write a lot: risk reports, policy papers, model documentation, findings. Hours in banks are steady; in Big 4 consulting they follow project deadlines; incident and resilience roles in global centres can be on call or in shifts.
The hardest part is saying no to the business, politely and with evidence. Good risk people are trusted because they understand how the business makes money, not just how it can lose it.