GRC Manager

Protiviti India; Dadri, Gurugram District, Coimbatore District; Presencial; INR 1.400.000 - 2.100.000; Tempo integral

Resumo da vaga

Protiviti India seeks an experienced information security governance professional to lead ISO 27001 and ISO 27701 programs, coordinate SOC 2 readiness, and manage governance documentation across India and the Middle East.

The role covers risk management, third-party risk, data protection compliance, audits, and reporting to senior leadership. Strong stakeholder skills and familiarity with DPDP Act and GDPR are essential.

Qualificações

• 7–10 years of experience in Information Security Governance, Risk Management, Compliance, Audit, or related functions.
• Experience managing ISO 27001 certification programs and audit activities.
• Experience supporting SOC 2 compliance and evidence management programs.
• Understanding of DPDP Act, GDPR, ISO 27001, SOC 2, and related regulatory requirements.
• Strong stakeholder management, communication, and program management skills.

Responsabilidades

• Lead and manage ISO 27001, ISO 27701 certification and surveillance activities across India and the Middle East.
• Coordinate SOC 2 audit readiness, evidence collection, and audit support activities.
• Manage security policies, standards, procedures, and governance documentation.
• Monitor compliance with firm security policies and regulatory requirements.
• Maintain and manage the enterprise information security risk register.
• Facilitate risk assessments, risk reviews, and risk treatment activities.
• Track remediation of identified risks and compliance findings.
• Prepare risk dashboards and reports for management review.
• Manage the Third-Party Risk Management (TPRM) program.
• Conduct vendor security assessments and risk reviews.
• Review vendor security documentation, security questionnaires, and compliance evidence.
• Track remediation of third-party security findings and exceptions.
• Support governance activities related to DPDP Act, GDPR, PDPL, and other applicable privacy regulations.
• Coordinate with the DPO and relevant stakeholders on privacy compliance initiatives.
• Maintain compliance records, trackers, and regulatory reporting requirements.
• Support vendor DPA administration and contractual compliance monitoring.
• Coordinate internal audits, external audits, and compliance assessments.
• Track audit observations, findings, and remediation activities.
• Ensure evidence and documentation are maintained for certification and audit requirements.
• Support client assessments, due diligence reviews, and compliance questionnaires.
• Prepare GRC dashboards, compliance reports, and management updates.
• Present program status, risks, and compliance metrics to leadership committees.
• Collaborate with business, technology, legal, and operational teams to drive compliance initiatives.
• Monitor regulatory developments and recommend necessary changes to the compliance framework.

Conhecimentos

ISO 27001

SOC 2

Risk management

Vendor security

Stakeholder mgmt

GRC dashboards

Audit coordination

Regulatory compliance

Privacy laws

DPO coordination

Formação

Bachelor's degree in IT/InfoSec/Law

Descrição da vaga

Key Responsibilities

1. Lead and manage ISO 27001, ISO 27701 certification and surveillance activities across India and the Middle East.
2. Coordinate SOC 2 audit readiness, evidence collection, and audit support activities.
3. Manage security policies, standards, procedures, and governance documentation.
4. Monitor compliance with firm security policies and regulatory requirements.

2. Risk Management

1. Maintain and manage the enterprise information security risk register.
2. Facilitate risk assessments, risk reviews, and risk treatment activities.
3. Track remediation of identified risks and compliance findings.
4. Prepare risk dashboards and reports for management review.

3. Third Party Risk Management

1. Manage the Third-Party Risk Management (TPRM) program.
2. Conduct vendor security assessments and risk reviews.
3. Review vendor security documentation, security questionnaires, and compliance evidence.
4. Track remediation of third-party security findings and exceptions.

4. Data Protection & Regulatory Compliance

1. Support governance activities related to DPDP Act, GDPR, PDPL, and other applicable privacy regulations.
2. Coordinate with the DPO and relevant stakeholders on privacy compliance initiatives.
3. Maintain compliance records, trackers, and regulatory reporting requirements.
4. Support vendor DPA administration and contractual compliance monitoring.

5. Audit & Assurance

1. Coordinate internal audits, external audits, and compliance assessments.
2. Track audit observations, findings, and remediation activities.
3. Ensure evidence and documentation are maintained for certification and audit requirements.
4. Support client assessments, due diligence reviews, and compliance questionnaires.

6. Reporting & Stakeholder Management

1. Prepare GRC dashboards, compliance reports, and management updates.
2. Present program status, risks, and compliance metrics to leadership committees.
3. Collaborate with business, technology, legal, and operational teams to drive compliance initiatives.
4. Monitor regulatory developments and recommend necessary changes to the compliance framework.

Qualifications & Experience

• Bachelors degree in information technology, Information Security, Business Administration, Law, Risk Management, or a related discipline.
• 7-10 years of experience in Information Security Governance, Risk Management, Compliance, Audit, or related functions.
• Experience managing ISO 27001 certification programs and audit activities.
• Experience supporting SOC 2 compliance and evidence management programs.
• Experience conducting risk assessments and maintaining risk registers.
• Experience managing third-party risk management and vendor security assessments.
• Understanding of DPDP Act, GDPR, ISO 27001, SOC 2, and related regulatory requirements.
• Strong stakeholder management, communication, and program management skills.