Sonata Software - Governance/Risk & Compliance Analyst

Analyst - GRC (Governance, Risk & Compliance).

Reports to: Portfolio CISO / VP Security | Experience: 4-5 years in GRC, audit, or compliance roles | Location: Pune| Type: Full-time.

ABOUT THE ROLE:

- The GRC Analyst will build and maintain the security governance framework across the portfolio companies.

- You will develop policies, maintain risk registers, manage vendor assessments, and drive compliance alignment across 17 portfolio companies with diverse regulatory obligations.

KEY RESPONSIBILITIES:

- Develop, maintain, and communicate Information Security Policy suite across portfolio.

- Build and manage technology risk registers for each portfolio company.

- Conduct annual vendor risk assessments and enforce security clauses.

- Lead data classification program rollout across all portfolio entities.

- Coordinate ISO 27001 and SOC 2 compliance efforts where applicable.

- Track policy exception requests, risk acceptances, and control deficiencies.

- Facilitate governance forums and prepare board/exec-level risk reporting.

- Manage security awareness training programs and phishing simulation schedules.

- Perform internal control assessments and maturity re-evaluations annually.

REQUIREMENTS & SKILLS:

- Bachelor's in Information Systems, Law, or Risk Management.

- 5+ years in GRC, audit, or InfoSec compliance roles.

- Strong knowledge of ISO 27001, NIST CSF, SOC 2, GDPR frameworks.

- Experience with GRC tools (ServiceNow, Archer, Vanta, Drata, OneTrust).

- Excellent documentation and policy writing skills.

- Ability to translate technical risks into business language for executives.

- Certifications preferred: CISM, CISA, CRISC, ISO 27001 Lead Implementer.

- Experience in multi-entity or portfolio-level governance environments.

- Strong stakeholder management and cross-functional communication skills.

TOOLS & TECHNOLOGIES: ServiceNow GRC, Archer, Reporting Drata, Power BI, Vanta, Microsoft Purview, ISO 27001, SOC 2, NIST CSF, OneTrust, Jira.