Cybersecurity Controls Assurance

Trent Limited; Mumbai, Navi Mumbai; On-site; INR 1,500,000 - 2,700,000; Full time

Job summary

Trent Limited seeks a cybersecurity controls professional to translate business risks into documented controls and manage their testing and validation across core systems. The role focuses on governance, audit support, and regulatory compliance to ensure controls operate effectively.

You will coordinate with process owners, define evidence requirements, and monitor control health indicators, aiming for robust risk reduction and control hygiene.

Qualifications

• Identify cyber risks that could cause financial loss or data leakage.
• Document controls with objective, owner, frequency and evidence.
• Review design stage controls for new initiatives and vendor onboarding.
• Define test procedures and evidence for control effectiveness.

Responsibilities

• Business-to-control translation: map risks to documented controls with ownership and evidence.
• Control validation and testing: perform TOD and TOE on an annual calendar.
• Effectiveness review: assess control efficiency and flag redundancies or high costs.
• Deficiency management: classify findings, assign remediation, re-test closures.
• Governance, reporting: prepare dashboards and support audits and regulatory reviews.
• Awareness: promote control culture and CSA design improvements.

Skills

Cyber risk management

Control testing

Audit coordination

Regulatory compliance

Tools

SAP

Cloud platforms

Data platforms

Job description

Key responsibilities

1. Business-to-control translation

• Work with process owners (Finance, Retail Ops, Supply Chain, HR, E-commerce, Customer) to identify where cyber risk can cause financial loss, misstatement, fraud, data leakage or disruption.
• Turn each business risk and policy commitment into a documented control: objective, owner, frequency, type (preventive/detective, manual/automated) and evidence required.
• Maintain the Cybersecurity Risk & Control Matrix (RCM) as part of the overall IFC framework, mapped to business processes and key systems.
• Ensure new business initiatives, system changes and vendor onboarding carry the right controls from day one, by reviewing them at design stage.

2. Control validation and testing

• Define test procedures for each control: what to sample, what evidence proves it works, and what counts as a failure.
• Perform test of design (TOD) and test of operating effectiveness (TOE) on a risk-based annual calendar.
• Cover core control areas: user access and segregation of duties, privileged access, change management, backup and recovery, logging and monitoring, vulnerability and patch management, endpoint and device controls, third-party/vendor access, and data protection.
• Validate controls across the key estate SAP, ETP, e-commerce, warehouse, cloud and data platforms – by reviewing evidence and outcomes, not by configuring systems.
• Verify that automated controls and system-generated reports used in financial controls are complete and accurate.

3. Effectiveness and efficiency review

• Assess whether each control actually reduces the risk it targets, and flag controls that are redundant, overlapping or too costly for the risk covered.
• Recommend rationalisation, automation or continuous monitoring where it lowers effort and improves reliability.
• Track control health indicators (failures, exceptions, overdue reviews) and report trends, not just point-in-time results.

4. Deficiency management and remediation

• Classify findings by severity (deficiency, significant deficiency, material weakness) using the IFC methodology.
• Agree remediation actions, owners and dates with business and Technology, and re-test closure.
• Escalate overdue or repeat issues through the IFC governance route.

5. Governance, reporting and audit support

• Prepare periodic cyber-control dashboards and notes for the Head of IFC, CFO, CTO and Audit Committee.
• Act as the single point of contact for statutory auditors, internal auditors and Tata Group reviews on cyber-related IFC controls; coordinate evidence and walkthroughs.
• Support management's IFC sign-off and MD/CFO certification with evidence on cyber controls.
• Track regulatory and contractual obligations that create control requirements – for example the DPDP Act, CERT-In directions and PCI DSS for card payments – and confirm they are reflected in the control set.

6. Awareness and control culture

• Help control owners understand their responsibilities, what evidence to retain, and why the control matters to the business.
• Contribute to control self-assessment (CSA) design and review its quality.