GRC Lead - Risk & Compliance

Coforge; Greater Noida; On-site; INR 800,000 - 1,100,000; Full time

Job summary

Coforge in India seeks a senior leader to own enterprise GRC strategy, aligning security, compliance, and business objectives while enabling secure digital transformation across global operations.

Responsibilities include defining enterprise GRC strategy, managing governance frameworks (ISO 27001, SOC 2, GDPR, PCI DSS, HIPAA), leading ERM, audits, and third-party risk; and driving automation and dashboards for risk visibility.

Qualifications

• Bachelor's or Master's in Engineering, IT, Cybersecurity.
• Certifications in CISA/CISM/CRISC/CISSP are preferred.
• Experience leading global GRC programmes and audits.

Responsibilities

• Define and execute enterprise GRC strategy aligned with objectives.
• Establish unified governance across geographies and units.
• Lead ERM activities: risk ID, assessment, mitigation, reporting.
• Oversee internal/external audits and certification efforts.
• Drive vendor risk management and third-party governance.
• Embed security/compliance into digital transformation initiatives.
• Develop dashboards and KPIs for risk visibility and reporting.

Skills

ISO 27001

SOC 2

GDPR

PCI DSS

NIST

ISO 22301

ERM

Audit lifecycle

TPRM

GRC governance

Executive reporting

Education

Bachelor's or Master's in Engineering/IT/Cybersecurity

Tools

Archer

ServiceNow

RSA Archer

OneTrust

Sprinto

Job description

Role Summary

Lead enterprise-wide Governance, Risk & Compliance (GRC) strategy to ensure a robust security posture, regulatory compliance, and risk visibility across global operations. Drive alignment of security, compliance, and business objectives while enabling secure digital transformation.

Key Responsibilities

1. GRC Strategy & Leadership

• Define and execute enterprise GRC strategy aligned with business and regulatory objectives.


• Establish unified governance frameworks across geographies and business units.


• Drive policy standardization, risk governance, and compliance transformation initiatives.

2. Governance & Framework Management

• Develop and maintain governance frameworks for:
  
  
  
  • ISO 27001
  
  
  • SOC 2
  
  
  • PCI DSS
  
  
  • GDPR
  
  
  • ISO 27701
  
  
  • HIPAA
  
  
  
  


• Design policy lifecycle management, audit cycles, and compliance workflows.


• Ensure alignment with enterprise architecture, SOC, and IT operations.

3. Risk Management & Compliance

• Lead Enterprise Risk Management (ERM), including:
  
  
  
  • Risk identification
  
  
  • Risk assessment
  
  
  • Risk mitigation
  
  
  • Risk reporting
  
  
  
  


• Conduct and oversee internal and external audits (ISO, SOC 2, regulatory).


• Ensure compliance with global regulatory and privacy requirements.

4. Audit, Assurance & Certifications

• Own audit strategy and execution, including:
  
  
  
  • Internal audits
  
  
  • External audits
  
  
  • Certification audits
  
  
  
  


• Drive closure of audit findings (Major/Minor Non-Conformities and OFIs) with business stakeholders.


• Manage certification roadmaps and sustain compliance posture.

5. Third-Party & Vendor Risk Management

• Establish and manage vendor risk management frameworks.


• Conduct due diligence, risk assessments, and compliance monitoring of third parties.


• Collaborate with procurement, legal, and IT security teams for vendor governance.

6. Security Governance & Business Alignment

• Advise business units on secure and compliant practices.


• Embed security and compliance into digital transformation, cloud, and AI initiatives.


• Enable risk-aware decision-making through dashboards and KPIs.

7. Incident Management & Resilience

• Oversee governance for incident response, forensic investigations, and recovery.


• Ensure business continuity, BCP/DR planning, and cyber resilience.


• Lead executive-level incident communication and escalation.

8. GRC Technology & Automation

• Drive GRC platform adoption and automation initiatives.


• Define roadmaps for risk visibility, control monitoring, and reporting systems.


• Leverage AI and analytics for predictive risk insights and compliance monitoring.

9. Stakeholder & Leadership Engagement

• Collaborate with CIO, CISO, Legal, Audit, and Business Leaders.


• Present risk posture, compliance status, and key issues to Board and CXO leadership.


• Drive cross-functional alignment and governance standardization.

10. Team Leadership & Capability Development

• Build and lead high-performing GRC teams across geographies.


• Develop capabilities in audit, risk, compliance, and governance domains.


• Conduct awareness programs and capability uplift initiatives.

Key Skills & Competencies

• Strong expertise in:
  
  
  
  • ISO 27001
  
  
  • SOC 2
  
  
  • GDPR
  
  
  • PCI DSS
  
  
  • NIST
  
  
  • ISO 22301
  
  
  
  


• Enterprise Risk Management (ERM) and regulatory compliance.


• Audit and certification lifecycle management.


• Third-Party Risk Management (TPRM).


• Cybersecurity governance and data privacy frameworks.


• GRC tools such as Archer, ServiceNow, RSA Archer, OneTrust, and Sprinto.


• Executive communication and Board-level reporting.

Qualifications

• Bachelor's or Master's degree in Engineering, Information Technology, Cybersecurity, or a related field.


• Preferred certifications:
  
  
  
  • CISA
  
  
  • CISM
  
  
  • CRISC
  
  
  • CISSP
  
  
  • ISO 27001 Lead Auditor
  
  
  • ISO 27001 Lead Implementer
  
  
  
  

Key Success Metrics (KPIs)

• Risk reduction through improvement in KRIs.


• Audit success rate and timely closure of non-compliance findings.


• Regulatory compliance adherence.


• Reduction in third-party risk exposure.


• GRC maturity and automation improvements.


• Business enablement through secure governance frameworks.

Ideal Profile

• Proven experience in leading large-scale global GRC functions.


• Strong stakeholder management skills with CXO and Board-level leadership.


• Demonstrated success in driving transformation, automation, and standardization.


• Ability to balance compliance requirements with business agility.

Mandatory Skills

• ISO 27001 Lead Auditor / Lead Implementer Certification


• PCI DSS


• Information Security Governance


• Enterprise Risk Management (ERM)


• Regulatory Compliance & Audits


• Third-Party Risk Management (TPRM)