Senior Information Security Risk Analyst

About Fam (previously FamPay)

Fam is India’s first payments app for everyone above 11. FamApp helps make online and offline payments through UPI and FamCard. We are on a mission to raise a new, financially aware generation, and drive 250 million+ young users in India to kickstart their financial journey super early in their life.

We’re reimagining how the next generation experiences fintech—going beyond payments to build a lifestyle brand that blends money, identity, and everyday experiences into one seamless, intuitive journey.

Founded in 2019 by IIT Roorkee alumni, Fam is backed by some of the most respected investors around the world like Elevation Capital, Y-Combinator, Peak XV (Sequoia Capital) India, Venture Highway, Global Founder’s Capital and the likes of Kunal Shah, Amrish Rao as angel investors.

Role Overview

We are seeking a proactive and detailed-oriented IT Risk & Third-Party Risk Management (TPRM) Specialist to join our team. In this role, you will be responsible for executing cybersecurity risk assessments for our third-party vendors, suppliers, service providers and internal IT risk management processes. You will collaborate closely with IT, Engineering, Procurement, Legal, and Risk teams to identify, evaluate, and mitigate technology and vendor risks across the organization.

Must-Haves

Experience:

3 to 5 years of dedicated experience in IT risk management, cybersecurity, third-party risk management (TPRM), or information security governance.

IT Risk Knowledge:

Strong understanding of internal IT general controls (ITGC), access control, disaster recovery, cloud security concepts, and data protection principles.

Framework Familiarity:

Working knowledge of industry frameworks and standards, such as RBI Framework for Outsourcing of Payment and Settlement-related Activities by PSOs, RBI MD on Cyber Resilience & Digital Payment Security Controls, ISO 27001, ISO 31000, and NIST CSF.

Artifact Evaluation:

Demonstrated ability to review vendor reports, security certifications, penetration test summaries, and questionnaires.

Analytical & Communication Skills:

Excellent analytical, organizational, and documentation skills with the ability to communicate risk findings clearly to both technical and business stakeholders.

Ownership:

Proven ability to manage multiple vendor assessments and internal risk tasks simultaneously in a fast-paced environment.

Good to Haves

Professional certifications or active progress toward certifications such as CISA, CRISC, ISO 27001 LA/LI etc.

Prior experience working in financial services, technology, or other regulated environments.

Hands-on experience using GRC tools or dedicated Third-Party Risk Management platforms.

Basic awareness of AI-enabled features in GRC or risk tools

Experience supporting IT disaster recovery exercises or business continuity planning.

Roles & Responsibilities

1. IT Risk Management

Risk Assessment & Identification:

Execute internal IT risk assessments across IT infrastructure, cloud environments, business applications, and operational workflows.

Risk Register Maintenance:

Maintain and regularly update the enterprise IT Risk Register, tracking risk treatment plans, remediation timelines, and risk acceptance approvals.

Internal Controls Evaluation:

Assess the effectiveness of internal IT controls, including access management, backup and disaster recovery, change management, and data security.

KRI & Risk Reporting:

Monitor Key Risk Indicators (KRIs) and assist in preparing periodic risk reports and metrics for management and oversight committees.

2. Third-Party Cyber Risk Management (TPRM)

Vendor Risk Assessments:

Perform end-to-end cybersecurity risk assessments for third-party vendors, suppliers, and external service providers.

Artefact Review & Analysis:

Review vendor security documentation, including reports, certifications, penetration testing summaries, architecture diagrams, and security policies.

Questionnaire Evaluation:

Review and evaluate vendor responses to cybersecurity questionnaires, due diligence requests, and risk evaluations.

Risk Quantification & Tracking:

Assign vendor risk ratings, document identified gaps, establish remediation action plans, and track vendor progress on outstanding risk items.

Cross-Functional Collaboration:

Work closely with Procurement, Legal, and stakeholder teams during vendor onboarding, ongoing monitoring, and contract reviews.

Incident Monitoring & Escalation:

Monitor vendor-related security incidents and advisory alerts, escalating potential issues in accordance with incident response protocols.

Why Join Us

High ownership:

Define and drive Fam’s IT risk posture from the ground up—shaping IT, IS & outsourcing risk frameworks.

Org-level impact:

Influence decision-making at the highest levels, working cross-functionally with security, legal, engineering, vendors and leadership to embed a strong risk and compliance culture across the org.

Zero to one opportunity:

Build scalable, audit-ready systems and processes in a fast-moving startup environment where your work directly enables product innovation and regulatory trust.

Mission-driven:

Be part of India’s first payments platform purpose-built for teenagers and young adults—balancing growth with trust, responsibility, and user safety.