Senior information security risk analyst at Fam Bengaluru, running IT risk management and third-party risk programs for a consumer payments company.

This full-time Bengaluru role was posted on 26 October 2026. The listing seeks an IT Risk and Third-Party Risk Management (TPRM) specialist covering IT risk management and vendor risk. Requirements include 3-5 years of dedicated experience in IT risk management, cybersecurity or TPRM, and strong understanding of internal IT general controls (ITGC), access control, disaster recovery and cloud risk.

About Fam

Fam (previously FamPay) describes itself as India's first payments app for everyone above 11. FamApp supports online and offline payments through UPI and the FamCard, with a stated mission of raising a financially aware generation and reaching 250 million+ young users in India. Per its listings, the company was founded in 2019 by IIT Roorkee alumni.

Fam is based in Bengaluru and hires across engineering, product, design, security and operations roles, per its listings. Learn more on Fam's website.

The role in plain terms

Third-party risk matters more in fintech than most sectors: payment companies depend on banks, card networks and cloud providers, and regulators ask about all of them. The 3-5 year band is a genuine mid-level risk seat with program ownership, not an analyst slot. The ITGC and access-control focus grounds the role in audit-grade control work rather than policy writing alone.

The team and the work

Per the listing, the company operates consumer payments on UPI rails, so the risk surface includes regulated financial infrastructure and a large young user base. The role sits within the security function at a startup scale, which typically means broad scope.

What the employer asks for

These requirements are quoted from the employer's listing, kept in their exact words so eligibility details are not distorted:

Experience: 3 to 5 years of dedicated experience in IT risk management, cybersecurity, third-party risk management (TPRM), or information security governance.
IT Risk Knowledge: Strong understanding of internal IT general controls (ITGC), access control, disaster recovery, cloud security concepts, and data protection principles.
Framework Familiarity: Working knowledge of industry frameworks and standards, such as RBI Framework for Outsourcing of Payment and Settlement-related Activities by PSOs, RBI MD on...
Artifact Evaluation: Demonstrated ability to review vendor reports, security certifications, penetration test summaries, and questionnaires.
Analytical & Communication Skills: Excellent analytical, organizational, and documentation skills with the ability to communicate risk findings clearly to both technical and business stakeholders.
Ownership: Proven ability to manage multiple vendor assessments and internal risk tasks simultaneously in a fast-paced environment.
Good to Haves
Professional certifications or active progress toward certifications such as CISA , CRISC , ISO 27001 LA/LI etc.

Who this role suits

IT risk, cybersecurity or TPRM professionals with 3-5 years, strong ITGC and access-control knowledge, and ideally fintech exposure. Not for penetration testers or security engineers - this is a governance and risk role.

Practical notes

For risk roles in fintech, expect questions on ITGC frameworks, vendor assessment methodology and how you handle a vendor that fails review mid-contract. Familiarity with India's financial regulatory expectations is worth surfacing.

Working at Fam

Work at Fam spans consumer payments on UPI rails, card products, and the infrastructure behind a high-volume consumer fintech app.

How to apply

Apply directly on the employer's site: Senior Information Security Risk Analyst at Fam. We found this listing on the Lever public postings feed (jobs.lever.co), where it was posted on 26 Oct 2026 and was still open when we checked on 30 Oct 2026. Before applying, re-read the employer's own description in full, since eligibility details, deadlines and process steps can change at any time and the employer's page is always the final word. Tailor your resume to the specific requirements above rather than sending a generic one: mirror the skills and tools the listing names where you genuinely have them. A short, specific note on why this team and this problem interest you goes further than a long generic cover letter. Never pay a fee to apply or interview; genuine employers, including this one, do not charge candidates.

Related openings on GetFirstJob

If this role is not the right fit, these current openings are in a similar area:

We write and maintain this page from the employer's public listing and link straight to their application page. We do not act as a recruiter, and applying is always free. If the link above stops working, the role has likely been filled.

This is our short summary of the employer's listing. The full description, eligibility and deadline are on the employer's page.