IT Compliance and Security Manager

RGP; Pune District; On-site; INR 1,200,000 - 2,200,000; Full time

Job summary

RGP in Pune seeks an IT Compliance & Security Manager to own the integrity of the cybersecurity framework, regulatory compliance (SOX) and data privacy programs. You will drive governance, risk controls, and security training across the organization.

Responsibilities include privacy governance, data mapping, PIAs, DSAR management, ITGC & SoD for SOX 404, vendor risk, and incident response collaboration with legal and IT teams.

Qualifications

• Bachelor’s degree in IT, Cybersecurity, or related field.
• 10+ years in IT security, audit, or compliance with SOX.
• CISSP, CISM, or CISA certifications preferred.
• Experience with privacy management software and LMS helpful.

Responsibilities

• Lead privacy governance, data mapping, and PIAs.
• Oversee DSAR processing and right-to-be-forgotten workflows.
• Design and monitor ITGCs and SoD to support SOX 404.
• Coordinate vendor risk assessments and SOC report reviews.
• Partner with legal and IT to manage security incidents.

Skills

SOX Compliance

IT Security

Data Privacy

Regulatory Audits

Education

Bachelor’s degree in IT/Cybersecurity/CS

Tools

OneTrust

GRC platforms

Job description

TheIT Compliance & Security Manager is responsible for the integrity of the organization’s cybersecurity framework, regulatory compliance (including SOX), and data privacy programs. This role ensures that our technical systems are secure, our financial reporting controls are airtight, and our data handling practices meet global privacy standards while fostering a security-first culture through comprehensive employee training.

What you will work on

• Privacy Governance: Develop and maintain policies to ensure compliance with global data privacy regulations (e.g., GDPR, CCPA/CPRA, HIPAA).
• Data Mapping: Lead data discovery and classification efforts to identify where sensitive and personal identifiable information (PII) resides.
• Privacy Impact Assessments (PIA): Conduct assessments for new projects or vendors to evaluate risks to individual privacy.
• DSAR Management: Oversee the process for fulfilling Data Subject Access Requests and ensuring "right to be forgotten" protocols are functional.
• Program Development: Design and deploy a mandatory company-wide security and privacy awareness curriculum.
• Phishing Simulations: Execute regular simulated phishing campaigns to test and improve employee vigilance; report on metrics to leadership.
• Targeted Training: Provide specialized training for high-risk groups, such as developers (secure coding) and finance teams (wire fraud/BEC prevention).
• Culture Leadership: Act as the internal champion for security, turning compliance requirements into understandable, everyday best practices for all staff.
• ITGC Management: Design and monitor General IT Controls (GITCs) and Segregation of Duties (SoD) to support SOX 404 requirements.
• Audit Liaison: Lead walkthroughs and evidence collection for internal and external auditors; manage the remediation of any identified control gaps.
• Change Control: Ensure all system changes follow a documented lifecycle of authorization, testing, and approval to maintain the integrity of financial systems.
• Third-Party Risk: Evaluate vendor SOC reports and privacy practices during the procurement process.
• Incident Response: Partner with legal and IT teams to manage security incidents, focusing specifically on data breach notification requirements.

WHAT YOU WILL BRING

• Bachelor’s degree in Information Technology, Cybersecurity, Computer Science, or a related field.
• 10+ years in IT security, audit, or compliance, with a proven track record in SOX environments and Data Privacy programs.
• Professional certifications such as CISSP, CISM, or CISA.
• Familiarity with GRC platforms, Privacy Management software (e.g., OneTrust), and Learning Management Systems (LMS).
• Exceptional ability to educate non-technical employees on complex security and privacy risks.