IT GRC-Assistant Manager

BDO India; Bengaluru; On-site; INR 2,500,000 - 4,500,000; Full time

Job summary

BDO India is seeking a techno-functional professional for its RegTech & Cyber Risk practice in Bengaluru. The role blends technology, regulation, and advisory work, including ITGC audits and regulatory compliance reviews.

You will interact directly with clients, oversee fieldwork, and contribute to practice development while aligning IT strategy with RBI directives. Exposure to RBI ITGRCA Master Direction, outsourcing norms, and digital lending guidelines is preferred.

Qualifications

• B.E./B.Tech/B.Sc IT/CS/ECE or B.Com/BBA with strong technology orientation; MBA/M.Tech is an advantage.
• Certifications in security and governance (CISA/CISSP/CISM/CRISC/CCSP) are valued.
• Hands-on experience in RBI IT governance, risk, controls and assurance concepts.

Responsibilities

• Assist in RBI ITGRCA related engagements and IT risk reviews.
• Lead ITGC audits, internal IT audits, and SOC report evaluations.
• Drive regulatory compliance audits across banks, NBFCs, fintechs, and other entities.
• Coordinate with client teams and supervise fieldwork of associates/consultants.
• Act as liaison during external regulatory inspections and audits.

Skills

RegTech experience

Regulatory compliance

IT audit

Controls testing

Client interaction

Analytics

Education

B.E./B.Tech/B.Sc (IT/CS/ECE) or B.Com/BBA

MBA/M.Tech an advantage

Certifications: CISA, CISSP, CISM, CompTIA Security+, CRISC, CCSP

Tools

SAP GRC

ServiceNow GRC

GRC tools

Job description

We are looking for a techno-functional professional to join our RegTech & Cyber Risk practice. The role sits at the intersection of technology, regulation, and compliance advisory requiring an individual who is equally at home reviewing IT systems and audit artefacts as they are interpreting RBI Master Directions and advising clients on compliance posture.

The successful candidate will work across regulatory compliance engagements covering the RBI IT Governance, Risk, Controls and Assurance (ITGRCA) framework, IT Outsourcing and TPRM norms, Digital Lending guidelines, Payment and Settlement Systems regulations, and frameworks governing Payment Aggregators / Payment Gateways (PA/PG) and Prepaid Payment Instruments (PPI). This is a growth-track role with direct client interaction and practice development responsibilities.

• Shall possess hands-on technical experience executing a diverse range of engagements,

including IT General Controls (ITGC) audits, comprehensive Internal Audits of complex IT

environments, and the evaluation/preparation of SOC reports.

• Shall independently drive and execute regulatory compliance audits spanning diverse

financial entities, including Banks, NBFCs, Fintechs, Insurance Brokers, and Stockbrokers

ensuring adherence to applicable RBI, SEBI, and IRDAI norms.

• Ability to critically evaluate technical evidence, identify inconsistencies, and detect control

circumvention risks across applications, databases, and infrastructure.

• Shall independently verify that the organizations IT strategy, policy frameworks, and Board

level oversight (ITSC/ACB) strictly align with regulatory Master Directions and maintain a

clear, independent reporting line for the CISO.

• Shall audit the security posture of the extended ecosystem, including third-party vendors,

outsourced IT services.

• Capability to seamlessly bridge the gap between technical IT controls and broader regulatory

expectations, translating complex cyber risks into clear business impacts.

• Shall validate the operational effectiveness of security monitoring (SOC), VAPT cycles, and

BCP/DR readiness to ensure the institution can detect threats in real-time and recover from

system failures within mandatory RPO/RTO targets.

• Susinftrong understanding of the control environments surrounding complex payment

flows, and third-party payment integrations.

• Supervise and review the fieldwork of senior associates/consultants, ensuring that audit

working papers, test scripts, and documentation meet rigorous qualitative standards.

• Collaborating with IT process owners to design practical, risk-mitigating controls and actively

tracking remediation plans to closure.

• Act as a key liaison during external regulatory inspections and statutory audits, facilitating

clear communication between technical IT teams, external auditors, and senior

management.

Educational Qualifications:

• B.E. / B.Tech / B.Sc. (IT/CS/ECE) or B.Com / BBA with strong technology orientation; MBA /

M.Tech is an advantage.

• Certifications considered - CISA, CISSP, CISM, CompTIA Security+, CRISC, CCSP

Regulatory Knowledge Essential

• RBI IT Governance, Risk, Controls and Assurance (ITGRCA) Master Direction
• RBI Master Direction on IT Outsourcing / Managing Risks in Outsourcing (NBFC / Banks)
• RBI Digital Lending Guidelines (2022 and subsequent updates)
• Payment and Settlement Systems (PSS) Act, 2007 and RBI DPSS frameworks

baseline security

• Prepaid Payment Instruments (PPI) Master Direction wallet issuance, interoperability, KYC

norms

• IT General Controls (ITGC) assessment - access management, change management,

operations, BCP/DR

• Application controls review - input validation, processing controls, output reconciliation
• Cybersecurity frameworks - familiarity with ISO 27001, NIST CSF, CIS Controls
• Data protection and privacy - DPDP Act 2023 awareness; data classification and handling

controls

• Cloud risk assessment - awareness of shared responsibility models, cloud-specific regulatory

requirements

Tools & Methodology

• Proficiency in MS Excel (audit/risk workbooks, control matrices, scoring models)
• MS PowerPoint - client-facing deliverable and deck preparation
• Familiarity with GRC tools (e.g., SAP GRC, ServiceNow GRC, or similar) is an advantage
• Comfort with data analysis and log review as part of IT audit fieldwork