Senior Information Security Risk Analyst

About Fam (previously FamPay)

Fam is India’s first payments app for everyone above 11. FamApp helps make online and offline payments through UPI and FamCard. We are on a mission to raise a new, financially aware generation, and drive 250 million+ young users in India to kickstart their financial journey super early in their life.

We’re reimagining how the next generation experiences fintech—going beyond payments to build a lifestyle brand that blends money, identity, and everyday experiences into one seamless, intuitive journey.

Founded in 2019 by IIT Roorkee alumni, Fam is backed by some of the most respected investors around the world like Elevation Capital, Y-Combinator, Peak XV (Sequoia Capital) India, Venture Highway, Global Founder’s Capital and the likes of Kunal Shah, Amrish Rao as angel investors.

Role OverviewWe are seeking a proactive and detailed-oriented IT Risk & Third-Party Risk Management (TPRM) Specialist to join our team. In this role, you will be responsible for executing cybersecurity risk assessments for our third-party vendors, suppliers, service providers and internal IT risk management processes. You will collaborate closely with IT, Engineering, Procurement, Legal, and Risk teams to identify, evaluate, and mitigate technology and vendor risks across the organization.

Must-Haves
Experience: 3 to 5 years of dedicated experience in IT risk management, cybersecurity, third-party risk management (TPRM), or information security governance.
IT Risk Knowledge: Strong understanding of internal IT general controls (ITGC), access control, disaster recovery, cloud security concepts, and data protection principles.
Framework Familiarity: Working knowledge of industry frameworks and standards, such as RBI Framework for Outsourcing of Payment and Settlement-related Activities by PSOs, RBI MD on Cyber Resilience & Digital Payment Security Controls, ISO 27001, ISO 31000, and NIST CSF.
Artifact Evaluation: Demonstrated ability to review vendor reports, security certifications, penetration test summaries, and questionnaires.
Analytical & Communication Skills: Excellent analytical, organizational, and documentation skills with the ability to communicate risk findings clearly to both technical and business stakeholders.
Ownership: Proven ability to manage multiple vendor assessments and internal risk tasks simultaneously in a fast-paced environment.

Good to Haves
Professional certifications or active progress toward certifications such as CISA, CRISC, ISO 27001 LA/LI etc.
Prior experience working in financial services, technology, or other regulated environments.
Hands-on experience using GRC tools or dedicated Third-Party Risk Management platforms.
Basic awareness of AI-enabled features in GRC or risk tools
Experience supporting IT disaster recovery exercises or business continuity planning.

Roles & Responsibilities
1. IT Risk Management
Risk Assessment & Identification: Execute internal IT risk assessments across IT infrastructure, cloud environments, business applications, and operational workflows.
Risk Register Maintenance: Maintain and regularly update the enterprise IT Risk Register, tracking risk treatment plans, remediation timelines, and risk acceptance approvals.
Internal Controls Evaluation: Assess the effectiveness of internal IT controls, including access management, backup and disaster recovery, change management, and data security.
KRI & Risk Reporting: Monitor Key Risk Indicators (KRIs) and assist in preparing periodic risk reports and metrics for management and oversight committees.
2. Third-Party Cyber Risk Management (TPRM)
Vendor Risk Assessments: Perform end-to-end cybersecurity risk assessments for third-party vendors, suppliers, and external service providers.
Artefact Review & Analysis: Review vendor security documentation, including reports, certifications, penetration testing summaries, architecture diagrams, and security policies.
Questionnaire Evaluation: Review and evaluate vendor res