Lead Governance, Risk & Compliance

Magma General Insurance Limited; Mumbai; On-site; INR 1,500,000 - 2,300,000; Full time

Job summary

Magma General Insurance Limited seeks a seasoned information security professional to manage audit responses, governance, and risk controls. The role involves coordinating RBI/IRDAI/UIDAI audits, translating security concerns into business terms, and ensuring policy compliance across IT and security domains.

Responsibilities include maintaining ISMS alignment, training content, and monitoring remediation efforts to close gaps promptly.

Qualifications

• Experience in information security governance and risk management.
• Familiarity with ISO 27001, ITGC, and regulatory compliance.

Responsibilities

• Lead audits for RBI, IRDAI, UIDAI as applicable, and coordinate with auditors.
• Define performance metrics for technology solutions and present to management.
• Develop, revise, and maintain information security policies and procedures.

Job description

• Well verse with implementation of ISO 27001 and ITGC controls, IT security Statutory requirement etc.
• Handling experience of RBI, IRDAI, UIDAI audits etc.
• Handle external/internal audits for the organization along with observation closures & its tracking.
• Respond to partner audit queries related to IS/IT controls and get into calls wherever required.
• Define performance metrics for technology solutions and assist during management presentation
• Assist with development, revision, and maintenance of Information Security and IT policies and procedures
• Perform defined risk assessment in coordination with CISO team for organization on timely basis
• Prepare and review content for Information security awareness training, emailers and conduct training whenever required.
• Control effectiveness measurement on monthly basis coordinating with IT operations and other teams.
• Understanding of Application security and Infrastructure vulnerability management program and co-ordinate with vendor team for closure of open points within teams
• Solutions understanding of EDR, DLP, SIEM, PIM etc.
• Ability to translate security concerns into business context and articulate to executives, while weighing business needs against security concerns in the decision-making process
• Attend Audits, Explain Company network security posture (both Corporate IT and Business IT) to Auditors
• Review RFP’s and respond to every requirement based on Company solution capabilities and fitment to project requirement.
• Ensure Audits are cleared from the regulation’s perspective
• Ensure the highest levels of compliance are achieved with the current technology that are implemented (focus on Lowest cost of compliance)
• Work with internal teams to ensure compliance to ISMS frameworks and Regulations applicable for Company are met in a timely manner
• Establish a governance process and drive compliance programs
• Responsible for assessing information risk and facilitates remediation of identified vulnerabilities for IT security and IT risk across the enterprise
• Identifies opportunities to reduce risk and documents remediation options regarding
• acceptance or mitigation of risk scenarios
• Responsible to ensure that all applications are functional and secure (IT security, Application Security, Cloud Security, Network Security and Information Security)
• Ensure Company Fintech solution application Security and application hosting infrastructure security is being taken care with utmost priority and build a process around it.
• Evaluates the organization to ensure compliance with standards and relevance with industry security norms
• Research, analyse and identify potential vulnerabilities and security deficiencies in the
• company’s information systems
• Monitors performance of risk remediation tasks, changes related to risk mitigation and reports on findings.
• Plan and prepare our network for periodic Audits for regulatory bodies and ensure compliance to guideline
• Analyse results, deploy remediation for security audits and penetration testing, working with internal TechOps stakeholders and Cybersecurity.