Senior GRC Analyst — Security Compliance Monitoring

Company Description

Established in 2011 and headquartered in Pune, METRO Global Solution Center (GSC) India is a strategic hub driving METRO’s global transformation. With 1,200+ professionals, we deliver specialized integrated expertise across Master Data Management, Information Technology, Cyber Security, Marketing & Design, Strategy, Finance & Accounting, Controlling (FP&A), and People & Culture (HR) solutions that drive operational excellence and digital innovation.

By supporting METRO’s sCore strategy, we enable sustainable growth and strengthen business processes. With a solutions-first mindset, we reduce complexity, accelerate transformation, and create measurable value for METRO businesses scaling up globally. METRO is a leading international food wholesaler operating in over 30 countries with a strong network of wholesale stores, digital marketplaces, and food service distribution. It supports businesses that keep the world running, from hotels, restaurants, and cafés to local retailers - offering quality, reliability, and smart solutions that help small and medium-sized businesses succeed.

Headquartered in Düsseldorf, Germany, METRO AG employs over 85,000 people worldwide and acts as the central management holding company of the group, driving strategic direction, and enabling consistent excellence across all markets. Around the world, METRO has approx. 15 million customers who benefit from the wholesale company’s unique multichannel mix: customers can purchase their goods in one of the large stores in their area as well as by delivery (Food Service Distribution, FSD) – all digitally supported and connected. In parallel, METRO MARKETS is being developed as an international online marketplace for professional customers, which has been growing and expanding continuously since 2019.

Acting sustainably is one of the company principles of METRO, which has been listed in various sustainability indices and rankings, including MSCI, Sustainalytics and CDP.

Job Description

Role purpose

Senior practitioner inside the Security Compliance Monitoring team. Beyond executing monitoring activities, you bring independent judgment, raise the quality bar for the more junior analysts, and partner with the Assistant Manager on complex or ambiguous work. The person we trust to think, not just do — and to coach the rest of the team to do the same.

Key responsibilities

• Lead the more complex control monitoring activities: those requiring interpretation, judgment on evidence sufficiency, or direct dialogue with control owners.
• Technical reviewer for junior analysts' work: spot-check evidence packages, validate findings, and provide constructive written feedback.
• Own end-to-end specific compliance workstreams ( supplier security reviews, policy exception management, AI governance evidence) with minimal supervision.
• Coach junior analysts on framework interpretation, stakeholder communication, and thinking about control effectiveness, not just existence.
• Partner with the Assistant Manager on SOP design, quality reviews, and continuous improvement; surface patterns and recommend changes.
• Represent the offshore team in onshore meetings on assigned topics; support audit preparation as a senior point of contact.

Qualifications

Must-have qualifications

• 5+ years in GRC, IT audit, information security, or a closely related field, with clear progression in scope and responsibility.
• Solid command of ISO/IEC 27001 (Annex A, ISMS clauses) and the ability to interpret controls in context, not mechanically.
• Demonstrated track record working with ambiguity: situations where the standard answer doesn't fit and judgment is required.
• Strong written English; able to produce stakeholder-ready analyses, briefing notes, and audit narratives with limited rework.
• Relevant certification: ISO 27001 Lead Implementer / Lead Auditor, CISA, CISM, or equivalent.

Nice to have

• Exposure to AI governance (ISO/IEC 42001, NIST AI RMF), NIS2, or DORA programs.
• Experience mentoring junior colleagues without formal line-management responsibility.

Background in retail, wholesale, or comparably large enterprise