Lead GRC

Ashley Global Capability Center; Chennai District; On-site; INR 1,200,000 - 1,800,000; Full time

Job summary

Ashley Global Capability Center in Chennai, Tamil Nadu is seeking a Lead GRC Engineer to enhance governance, risk, and compliance programs across PCI-DSS compliance and third-party risk management. The ideal candidate will possess a bachelor’s degree in information security or related fields, and have 8+ years of experience in enterprise GRC platforms and policy governance.

This role emphasizes operational discipline and collaboration across teams, enhancing security awareness and ensuring adherence to compliance requirements. Candidates with relevant certifications, such as ISO 27001 Lead Auditor or CISSP, will be preferred.

Qualifications

• 8 or more years of experience with enterprise GRC platforms.
• Strong experience maintaining cybersecurity policies and procedures.
• Proven success in PCI audits and vendor risk assessments.

Responsibilities

• Lead PCI-DSS audit readiness and evidence collection.
• Execute third-party risk management and vendor due diligence.
• Drive policy governance and elevate security awareness.
• Partner across functions to resolve GRC matters.

Skills

Risk management methodologies

Governance frameworks

Compliance expertise

Cybersecurity knowledge

Vendor risk assessments

Education

Bachelor’s degree in information security, Computer Science, or related discipline

Tools

OneTrust

RSA Archer

ServiceNow GRC

Job description

The Lead GRC Engineer is a strategic and execution-focused governance, risk, and compliance professional responsible for advancing key programs across PCI-DSS compliance, third-party risk management, policy governance, enterprise risk management, and security awareness. This role drives PCI audit readiness and execution, leads vendor due diligence and risk assessments, maintains cybersecurity policies and standards, coordinates phishing simulation initiatives, and supports compliance reporting and remediation activities. The position requires strong operational discipline, cross-functional partnership, and the ability to translate complex regulatory requirements into actionable business practices.

Primary Job Functions:

• Leading PCI-DSS audit readiness with QSAs, evidence collection, and sustained compliance. Strengthening enterprise risk management with NIST RMF & ISO 27005, delivering actionable insights to leadership.
• Executing third-party risk management with vendor due diligence, remediation tracking, and risk register maintenance.
• Driving policy governance by aligning cybersecurity policies with business and regulatory needs. Elevating security awareness through phishing simulations, targeted education, and compliance training.
• Partnering cross-functionally across India GCC & US operations to resolve complex GRC matters.

Knowledge, Skills and Abilities:

• Strong knowledge of risk management methodologies, governance frameworks, control processes, and industry-standard GRC practices.
• Demonstrated expertise across compliance and cybersecurity domains.
• Proven success supporting at least 4 to 5 PCI audits through successful completion.
• Experience executing and reviewing annual vendor risk assessments for 30 or more vendors using platforms such as OneTrust, RSA Archer, ServiceNow GRC, or similar tools.
• 8 or more years of experience working with enterprise GRC platforms such as ServiceNow GRC, RSA Archer, MetricStream, or equivalent solutions.
• Strong experience developing and maintaining cybersecurity policies, standards, and procedures.

Experience:

9–13 years of progressive experience in GRC and cybersecurity, with hands‑on expertise in PCI-DSS, third-party risk management, and policy governance.

Education:

Bachelor’s degree in information security, Computer Science, Information Technology, or a related discipline required; equivalent relevant experience may be considered.

Licenses or Certifications:

At least one relevant industry certification, such as ISO 27001 Lead Auditor, CRISC, or CISSP, required.