Information Security Risk & Privacy

UGRO Capital Limited; Dadri; On-site; INR 4,000,000 - 8,000,000; Full time

Job summary

UGRO Capital Limited invites a senior Information Security, Risk & Privacy professional to drive governance, risk management and privacy programs across the organization. The role emphasizes vendor risk, regulatory compliance and data protection in a fintech environment.

The incumbent will coordinate audits, manage DSAR processes, implement DPDP controls and oversee security policy management with cross-functional teams. Strong communication and stakeholder management are essential.

Qualifications

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity or a related discipline.

Responsibilities

• Coordinate third-party risk management programs and assess vendor IT, data flow and security.
• Lead privacy and data protection activities including DPDP and DSAR coordination.
• Oversee DLP, policy management and incident response planning.
• Coordinate security audits, evidence collection, and management responses.
• Maintain cybersecurity risk registers and remediation tracking.
• Support regulatory compliance with RBI, SEBI, IRDAI and CERT-In.
• Manage security governance, documentation and control validation.
• Deliver management-ready cybersecurity risk and compliance reports.

Skills

Information Security Governance

Risk Management

Privacy & Data Protection

GRC & Regulatory Compliance

Stakeholder Management

Audit & Remediation

Cybersecurity Awareness

Education

Bachelor's degree in Computer Science / IT / Cybersecurity

Tools

ISO 27001

CISA

CDPSE

CIPP/E

CIPM

CIPT

Job description

Job Title: Information Security, Risk & Privacy

Job Summary

We are looking for an Information Security, Risk & Privacy professional with 23 years of experience to support the organizations Information Security, Cyber Risk, Third-Party Risk Management, Privacy and Compliance programs.The candidate should have a practical understanding of cybersecurity governance, risk management, privacy and regulatory requirements, along with good analytical, documentation

and stakeholder management skills.

Key Responsibilities

1. Third-Party Risk Management

• Understand the business requirement and proposed solution, including the architecture, integration approach, data flow and nature of data being processed.
• Coordinate with vendors and relevant Business, Data and IT SPOCs to understand the solution, technology stack, connectivity and data movement.
• Conduct Information Security and Cyber Risk Assessments for vendors and third-party solutions and identify applicable security, privacy and regulatory requirements.
• Prepare and issue risk assessment reports highlighting identified risks, control gaps, residual risks and recommended mitigation measures.
• Coordinate with Business and relevant stakeholders to ensure identified recommendations are implemented within agreed timelines.
• Where identified risks cannot be remediated, coordinate the formal risk acceptance process with the appropriate risk owner.
• Maintain the organization-level third-party risk register and track open vendor risks, agreed controls and remediation status.
• Present significant or residual vendor risks to relevant stakeholders and the CISO for review and decision-making.
• Review MSA, NDA and other contractual documents from an Information Security perspective and ensure inclusion of relevant clauses covering information security, data protection, data retention and purging, right to audit, SLA, breach notification, liability/penalty and other applicable security requirements.
• Apply relevant RBI Master Directions on outsourcing, DPDP requirements and industry frameworks such as ISO 27001 and GDPR while conducting third-party assessments.

2. Privacy & Data Protection

• Own the Records of Processing Activities (ROPAs) lifecycle, including new assessments, periodic attestations, approvals and updates arising from business or process changes.
• Conduct periodic ROPA reviews and mock audits as per the defined internal methodology, including sampling, review of scope elements, identification of gaps and tracking of corrective actions.
• Support management of Data Subject Rights Requests (DSARs) and coordinate with relevant stakeholders to ensure timely responses.
• Support investigation and documentation of privacy incidents and personal data breaches.
• Coordinate root cause analysis, corrective actions and closure of privacy-related incidents.
• Identify, assess and monitor privacy and data protection risks across business processes.
• Assess privacy implications of new products, services, technology implementations and third-party engagements.
• Support implementation and monitoring of DPDP-related requirements and controls.
• Assess the security and privacy posture of solutions used for processing organizational or customer data, including third-party software, SaaS and IaaS platforms.

3. Data Loss Prevention (DLP) & Security Policy Management

• Support implementation and maintenance of DLP and Proxy security policies across the organization.
• Review DLP and Proxy policy exceptions and ensure appropriate business justification, approval and tracking.
• Monitor and analyse High and Medium severity DLP incidents and coordinate required actions with relevant teams.
• Work with IT and Security teams to fine-tune DLP and Proxy policies based on identified risks and operational requirements.
• Support periodic review and update of Information Security policies, standards and procedures.
• Track policy-related actions, approvals and implementation requirements.

4. Audit, Compliance & Regulatory

• Coordinate Information Security and Cybersecurity audits, including internal, external and regulatory audits.
• Coordinate with relevant stakeholders for timely collection, validation and submission of audit evidence and management responses.
• Maintain audit trackers and follow up with control owners for timely closure of observations.
• Support compliance with applicable regulatory and industry requirements, including RBI, SEBI, IRDAI, CERT-In and other applicable requirements.
• Maintain working knowledge of applicable Cyber Security and Cyber Resilience Frameworks, DPDP requirements and Digital Accessibility requirements.
• Support regulatory gap assessments and implementation of required controls.
• Support periodic review of Information Security policies, standards, procedures and controls against regulatory and industry requirements.

5. Information Security & Cyber Risk

• Support identification, assessment and monitoring of Information Security and Cybersecurity risks across the organization.
• Work with IT and Business teams to ensure appropriate security controls are considered and implemented across applications, systems and business processes.
• Review security risks associated with new projects, applications, technologies, processchanges and integrations.
• Maintain cybersecurity risk registers, action trackers andremediation status.
• Perform control validation and periodic checks to assess compliance with internal policies, procedures and regulatory requirements.
• Conduct periodic checks covering areas such as access management, data protection, endpoint security and network security controls.
• Document identified deviations and coordinate corrective action plans with respective control owners.
• Support preparation of periodic cybersecurity risk and compliance reports for management review.

6. Cyber Resilience & Security Awareness

• Coordinate tabletop exercises, incident simulations and other cyber resilience activities.
• Track actions and remediation items identified during exercises and simulations.
• Support cybersecurity awareness initiatives covering phishing, data protection, information security and cyber hygiene.
• Assist in tracking awareness participation, identified gaps and required follow-up actions.

Qualifications & Experience

• Bachelors degree in Computer Science, Information Technology, Cybersecurity or a related discipline.
• 23 years of experience in Information Security, Cybersecurity GRC, Risk Management, Compliance, TPRM or privacy.
• Practical understanding of Information Security Governance and Risk Management.
• Working knowledge of Third-Party Risk Management and security due diligence.
• Understanding of security and compliance audits and remediation tracking.
• Understanding of Information Security policies, controls and governance processes.
• Working knowledge of privacy and data protection principles.
• Basic understanding of incident management and cyber resilience.
• Exposure to regulatory requirements applicable to financial services, including RBI, SEBI, IRDAI and CERT-In.
• Good understanding of DPDP requirements and data protection practices.
• Exposure to Cyber Security and Cyber Resilience Frameworks and Digital Accessibility requirements will be an advantage.
• Professional certifications such as ISO 27001, CISA, CDPSE, CIPP/E, CIPM, CIPT or equivalent will be an advantage.
• Experience in fintech, NBFC, banking, payments, financial services or consulting will be preferred.
• Strong analytical, documentation and follow-up skills.
• Good stakeholder management and communication skills, with the ability to work with both technical and non-technical teams.
• Ability to manage multiple assessments, audits, risks and remediation activities simultaneously.

Key Competencies

• Information Security & Cyber Risk
• Third-Party Risk Management
• Privacy & Data Protection
• GRC & Regulatory Compliance
• Security Assessment & Control Validation
• Audit & Remediation Management
• Risk Documentation & Reporting
• Stakeholder Management
• Analytical & Problem-Solving Skills
• Execution and Follow-through