Lead - Governance, Risk & Compliance

ZS; Pune District; Hybrid; INR 4,000,000 - 6,000,000; Full time

Benefits offered by this job

Hybrid working model

Travel opportunities

Total rewards package

Job summary

ZS is seeking a Lead – Governance, Risk & Compliance to join its team. The consultant will act as a hands‑on Technology Risk Assessment SME for applications, AI solutions, cloud services, and third‑party technologies, leading risk assessments and remediation activity.

The role requires 6+ years of experience in technology risk, security governance, and DevSecOps, with strong communication and stakeholder‑management skills.

Qualifications

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, Engineering, Information Systems or a related discipline.
• Mandatory certifications — CEH, ISO 27001 Lead auditor, ISO/IEC 42001 Lead Auditor.
• Fluency in English.
• Client‑first mentality.
• Intense work ethic.
• Collaborative spirit and problem‑solving approach.

Responsibilities

• Lead and deliver technical security audits — hands‑on security assessment for applications, AI and cloud hosted solutions.
• Scope assessments based on business criticality, data classification, hosting model and regulatory obligations.
• Develop understanding of product functionality, data flows, architecture and risk scenarios.
• Assess solutions across ideation, architecture, design, development, testing, release, production operations and decommissioning.
• Participate in architecture reviews, governance, release‑readiness and provide risk recommendations.
• Oversee remediation items with owners and target dates; support risk escalations and incident responses.
• Develop management reporting on assessment coverage, findings, and remediation performance.
• Contribute to policies, standards, control libraries, and automation initiatives.
• Secure SDLC and DevSecOps including threat modelling, SAST/DAST, CI/CD security.
• Review data provenance, compliance, and model governance for AI/ML solutions.
• Evaluate AI/ML risks including prompt injection, data privacy, and model integrity.

Skills

Strong analytical skills

Facilitation

Stakeholder management

Technical writing

Executive communication

Fluency in English

Education

Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, Engineering, Information Systems or a related discipline

CEH

ISO 27001 Lead Auditor

ISO/IEC 42001 Lead Auditor

Job description

ZS is a place where passion changes lives. As a management consulting and technology firm focused on improving life and how we live it, we transform ideas into impact by bringing together data, science, technology and human ingenuity to deliver better outcomes for all. Here you’ll work side‑by‑side with a powerful collective of thinkers and experts shaping life‑changing solutions for patients, caregivers and consumers, worldwide. ZSers drive impact by bringing a client‑first mentality to each and every engagement. We partner collaboratively with our clients to develop custom solutions and technology products that create value and deliver company results across critical areas of their business. Bring your curiosity for learning, bold ideas, courage and passion to drive life‑changing impact to ZS.

Lead – Governance, Risk & Compliance

ZS is looking for a skilled and driven Lead– Governance, Risk & Compliance to join its Governance, Risk, and Compliance team. The consultant will serve as a hands‑on Technology Risk Assessment subject‑matter expert for applications, products, platforms, AI solutions, tools, cloud services, third‑party technologies, and emerging technologies.

• Independently lead and deliver Application Security Governance, AI Risk Assessment, project‑risk and material‑change assessments for internal, client‑facing, cloud‑hosted, client‑hosted, third‑party and AI‑enabled solutions.
• Determine assessment scope and applicable control requirements based on business criticality, data classification, external exposure, hosting model, technology stack, user population, regulatory and contractual obligations, AI usage, third‑party dependencies and change magnitude.
• Develop a detailed understanding of product functionality, user journeys, architecture, data flows, trust boundaries, integrations, deployment models, administrative access and operational dependencies to identify credible risk scenarios.
• Assess solutions across ideation, architecture, design, development, testing, release, production operations, material change, migration and decommissioning.
• Participate in architecture reviews, design governance, stage gates, release‑readiness reviews and production‑readiness reviews, and provide documented risk recommendations.
• Evaluate inherent risk, control design and operating effectiveness, residual risk, compensating controls, remediation plans, exceptions and closure evidence using the approved risk methodology.
• Conduct review sessions with product owners, architects, engineers, developers, data scientists, security, privacy, legal, compliance, procurement and operations teams.
• Produce clear and defensible assessment reports documenting scope, assumptions, system context, evidence reviewed, risk scenarios, findings, ratings, residual risk, actions, dependencies and approval recommendations.
• Oversee high and critical remediation items, including accountable owners, target dates, interim safeguards, escalation, risk acceptance and closure validation.
• Support material incidents and risk escalations, identify root causes and recurring control weaknesses, and recommend program‑level improvements.
• Develop management reporting covering assessment coverage, material findings, overdue actions, exceptions, recurring issues, trends and remediation performance.
• Contribute to policies, standards, procedures, control libraries, evidence standards, assessment playbooks, training, automation and continuous improvement.
• Secure SDLC and DevSecOps, including architecture review, threat modelling, SAST, DAST, API testing, software composition analysis, secrets management, penetration testing, CI/CD security, infrastructure as code and remediation validation.
• Modern architectures, including microservices, APIs, event‑driven systems, containers, Kubernetes, serverless computing, SaaS, PaaS, IaaS, mobile, data and analytics platforms and low‑code/no‑code solutions.
• Identity and access management, encryption and key management, logging and monitoring, vulnerability management, environment segregation, third‑party integrations, incident response, availability, backup, recovery, resilience and secure decommissioning.
• Technical evidence, including architecture and data‑flow diagrams, API specifications, threat models, cloud configurations, pipelines, test reports, vulnerability reports, deployment workflows, operating records and control demonstrations.
• Assess AI and machine‑learning solutions across data sourcing, model selection, training or fine‑tuning, validation, hosting, access, integrations, third‑party dependencies, deployment, monitoring, human oversight, suspension and retirement.
• Evaluate generative AI, foundation and open‑source models, retrieval‑augmented generation, agents, copilots, AI APIs, vector databases, plugins, tools and Model Context Protocol integrations.
• Assess risks including prompt injection, jailbreaks, insecure output handling, sensitive‑data disclosure, model or data poisoning, hallucination, bias, toxicity, privacy leakage, excessive agency, weak tool permissions, supply‑chain exposure, model theft and unsafe actions.
• Review data provenance, lawful use, consent, quality, representativeness, lineage, retention, intellectual property, training and inference‑data protection, residency and cross‑border requirements.
• Evaluate accuracy, robustness, explainability, benchmark selection, performance thresholds, validation independence, human approval, action limits, memory, identity propagation, kill switches, rollback and fail‑safe behaviour.
• Define or review monitoring for model and data drift, anomalous behaviour, harmful outputs, performance degradation, incidents, complaints and regulatory or use‑case changes.
• ISO/IEC 27001 and 27005, ISO 31000, NIST Cybersecurity Framework, NIST SP 800‑53/30, NIST Secure Software Development Framework (SP 800‑218), SOC 2, CIS Controls and Cloud Security Alliance guidance, including the Cloud Controls Matrix.
• OWASP Top 10, Application Security Verification Standard, API Security Top 10, Software Assurance Maturity Model, OWASP guidance for LLM applications.
• NIST AI Risk Management Framework, ISO/IEC 42001, ISO/IEC 23894, AIUC‑1, responsible AI principles and applicable AI regulatory expectations, including the EU AI Act where relevant.

What You’ll Bring:

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, Engineering, Information Systems or a related discipline.
• Minimum of 6+ years of professional experience in technology risk, Application security assessment, Cybersecurity assurance, security architecture, IT Audit, AI assessment & governance, DevSecOps governance — with significant experience at a Big 4, Big 3.
• Demonstrated track record of leading and executing technical security audits — hands‑on experience conducting walkthroughs, reviewing evidence, and making independent control assessments.
• Strong technical foundation across SDLC governance, CI/CD pipeline security, cloud security controls, access and identity management, application security, and secrets management.
• Demonstrated experience independently scoping, conducting, documenting and concluding complex application or technology risk assessments.
• Experience reviewing the work of other assessors and challenging scope, evidence, control conclusions, findings, ratings, remediation and closure decisions.
• Ability to distinguish control design effectiveness from operating effectiveness and determine whether evidence is complete, current, relevant, reliable and sufficient.
• Strong analytical, facilitation, stakeholder‑management, technical‑writing and executive‑communication skills, with the ability to exercise independent judgement and manage concurrent priorities.
• Mandatory certifications — CEH, ISO 27001 Lead auditor, ISO/IEC 42001 Lead Auditor.
• Fluency in English.
• Client‑first mentality.
• Intense work ethic.
• Collaborative spirit and problem‑solving approach.

How you’ll grow:

• Cross‑functional skills development & custom learning pathways.
• Milestone training programs aligned to career progression opportunities.
• Internal mobility paths that empower growth via s‑curves, individual contribution and role expansions.

Perks & Benefits:

At ZS, your growth matters. We offer a comprehensive total rewards package that supports your health and well‑being, financial future, time away, and professional development. With robust skills‑building programs, multiple career progression paths, internal mobility, and a deeply collaborative culture, you’ll have the opportunity to do meaningful work, expand your capabilities, and thrive as part of a global community. For details on total rewards in India, visit ZS India office locations | Where we work | ZS.

Hybrid working model:

We are committed to giving our employees a flexible and connected way of working. A flexible and connected ZS allows us to combine work from home and on‑site presence at clients/ZS offices for the majority of our week. The magic of ZS culture and innovation thrives in both planned and spontaneous face‑to‑face connections.

Travel:

Travel is a requirement at ZS for client facing ZSers; business needs of your project and client are the priority. While some projects may be local, all client‑facing ZSers should be prepared to travel as needed. Travel provides opportunities to strengthen client relationships, gain diverse experiences, and enhance professional growth by working in different environments and cultures.

Considering applying?

At ZS, we honor the visible and invisible elements of our identities, personal experiences, and belief systems—the ones that comprise us as individuals, shape who we are, and make us unique. We believe your personal interests, identities, and desire to learn are integral to your success here. We are committed to building a team that reflects a broad variety of backgrounds, perspectives, and experiences.

ZS is an equal opportunity employer and is committed to providing equal employment and advancement opportunities without regard to any class protected by applicable law.