Sonata Software - Governance/Risk & Compliance Analyst

Analyst - GRC (Governance, Risk & Compliance).
Reports to: Portfolio CISO / VP Security | Experience: 4-5 years in GRC, audit, or compliance roles | Location: Pune| Type: Full-time.
ABOUT THE ROLE:

- The GRC Analyst will build and maintain the security governance framework across the portfolio companies.
- You will develop policies, maintain risk registers, manage vendor assessments, and drive compliance alignment across 17 portfolio companies with diverse regulatory obligations.
KEY RESPONSIBILITIES:
- Develop, maintain, and communicate Information Security Policy suite across portfolio.

- Build and manage technology risk registers for each portfolio company.
- Conduct annual vendor risk assessments and enforce security clauses.
- Lead data classification program rollout across all portfolio entities.
- Coordinate ISO 27001 and SOC 2 compliance efforts where applicable.
- Track policy exception requests, risk acceptances, and control deficiencies.
- Facilitate governance forums and prepare board/exec-level risk reporting.
- Manage security awareness training programs and phishing simulation schedules.
- Perform internal control assessments and maturity re-evaluations annually.
REQUIREMENTS & SKILLS:
- Bachelor's in Information Systems, Law, or Risk Management.
- 5+ years in GRC, audit, or InfoSec compliance roles.
- Strong knowledge of ISO 27001, NIST CSF, SOC 2, GDPR frameworks.
- Experience with GRC tools (ServiceNow, Archer, Vanta, Drata, OneTrust).
- Excellent documentation and policy writing skills.
- Ability to translate technical risks into business language for executives.
- Certifications preferred: CISM, CISA, CRISC, ISO 27001 Lead Implementer.
- Experience in multi-entity or portfolio-level governance environments.
- Strong stakeholder management and cross-functional communication skills.
TOOLS & TECHNOLOGIES: ServiceNow GRC, Archer, Reporting Drata, Power BI, Vanta, Microsoft Purview, ISO 27001, SOC 2, NIST CSF, OneTrust, Jira.