Head - GRC

APEX Analytix, LLC; Dadri; Hybrid; INR 3,500,000 - 6,000,000; Full time

Job summary

apexanalytix is seeking an experienced governance, risk and compliance leader to serve as Head of GRC, based in the United States or in Noida, India. The role reports to the CPTO, owns the control framework, ISO 27001, SOC 1 and SOC 2 programs, and enterprise and third-party risk management, providing independent assurance that controls run across the organization as intended.

The Head of GRC leads the handover of Security Operations to Technology Operations and builds a focused assurance

Qualifications

• Extensive experience leading GRC programs at scale.
• Proven ability to define and implement policy frameworks and controls.
• Experience coordinating ISO/SOC audits and regulatory compliance.

Responsibilities

• Define and run a multi-year GRC strategy and roadmap.
• Own ISO 27001, SOC 1 Type II and SOC 2 Type II programs and audit scope.
• Lead independent control testing across Security Operations, Technology Operations and Product teams.
• Manage third-party risk and regulatory obligations across multiple jurisdictions.

Skills

GRC leadership

ISO 27001

SOC 1 Type II

SOC 2 Type II

NIST CSF

Regulatory compliance

Risk management

Audits

Vendor risk

AI governance

Job description

At apexanalytix, we’re lifelong innovators! Since the date of our founding nearly four decades ago we’ve been consistently growing, profitable, and delivering the best procure-to-pay solutions to the world. We’re the perfect balance of established company and start-up. You will find a unique home here.

And you’ll recognize the names of our clients. Most of them are on The Global 2000. They trust us to give them the latest in controls, audit and analytics software every day. Industry analysts consistently rank us as a top supplier management solution, and you’ll be helping build that reputation.

apexanalytix is seeking an experienced governance, risk and compliance leader to serve as Head of GRC, based in the United States or in Noida, India. The role reports to the Chief Product & Technology Officer (CPTO), who leads apexanalytix's global engineering, product and hosted IT organizations. As a member of the CPTO's leadership team, the Head of GRC owns the company's control framework, its ISO 27001, SOC 1 and SOC 2 programs, and its enterprise and third-party risk management, and gives independent assurance that the controls run across the organization work as intended.

The role is deliberately independent of the controls it tests. Security Operations, the datacenter, production environments and corporate IT sit with the VP Technology Operations. Product identity and security tooling in the delivery pipeline sit with the Platform team. GRC sets the standards these teams work to, tests whether their controls work, and reports the results directly to the CPTO.

Today the GRC team also runs security operations. Under the new organization design, Security Operations moves to Technology Operations. The Head of GRC leads that handover and then builds GRC into a focused, independent assurance function.

• Advises the CPTO, the executive team and, as needed, the Board or Audit Committee on the company's risk position, compliance obligations and the state of its controls.
• Gives product and engineering leaders an early, clear view of the compliance and risk impact of new products, AI capabilities, architecture changes and acquisitions.
• Acts as the senior voice of security and compliance assurance toward enterprise customers, auditors and regulators.
• Works with Legal, Privacy and Finance to turn regulatory and contractual obligations into practical control requirements.

The Work -

Governance and compliance

• Strategy and governance. Defines and runs a multi-year GRC strategy and roadmap. Chairs the company's risk and compliance forums and reports regularly to the CPTO and the executive team.
• Policy framework. Owns security policy and standards, including annual review, exceptions and employee attestation.
• Certifications and audits. Leads the ISO/IEC 27001, SOC 1 Type II and SOC 2 Type II programs and any further attestations the market requires. Manages external auditors and owns audit scope, evidence coordination, findings and remediation tracking.
• Control framework. Maintains a single control framework mapped across NIST CSF, ISO 27001, SOC 2 and CIS, so each control is tested once and used to meet many requirements.
• Regulatory obligations. Tracks obligations across the jurisdictions the company operates in, including GDPR, CCPA/CPRA, DORA, NIS2, the EU AI Act, India's Digital Personal Data Protection Act (DPDP Act) and CERT-In incident reporting rules.

Risk and assurance

• Independent control testing. Sets control requirements and tests how well controls work across Security Operations, Technology Operations, corporate IT, Platform and the product trios. Runs periodic access reviews and segregation-of-duties checks.
• Vulnerability and risk reporting. Monitors vulnerability management and patching against agreed SLAs and escalates breaches directly to the CPTO. Defines and reports key risk indicators for security, availability and access.
• Enterprise risk management. Runs the enterprise and information security risk program: risk identification and assessment, the risk register, treatment plans and named risk owners.
• Incident and resilience oversight. Reviews security incidents after they close to check whether controls worked and notification obligations were met. Sets business continuity and disaster recovery requirements and confirms that the plans owned by Technology Operations are tested.
• Third-party risk. Owns third-party risk management for subprocessors, cloud providers and critical suppliers, from due diligence through ongoing monitoring, using apexanalytix's own supplier risk capabilities where appropriate.
• AI governance. Works with the Head of AI & Data to set governance for models and agents, including risk assessment, guardrails and audit scope.

Customer trust

• Customer assurance. Oversees responses to security questionnaires, RFP security sections, due diligence requests and customer audits. Maintains a trust center and a standard documentation package that shortens sales cycles.
• Contract support. Advises Sales, Legal and Customer Success on security and compliance commitments in contracts, data processing agreements and SLAs.