Lead - IT Governance

Godrej Industries Group; Mumbai; On-site; INR 1,500,000 - 2,500,000; Full time

Job summary

Godrej Industries Group is seeking an experienced IT Governance professional in Mumbai to oversee compliance with RBI IT regulations. The role requires 8–10 years of experience in IT governance, risk management, and assurance practices. Responsibilities include ensuring strategic alignment, managing compliance inventories, overseeing IT outsourcing policies, and validating the effectiveness of IT controls. The ideal candidate will facilitate BCP/DR testing and manage cyber risks effectively.

Qualifications

• 8–10 years of experience in IT governance and risk management.
• In-depth knowledge of RBI IT Governance, Risk, Controls & Assurance Practices.

Responsibilities

• Provide independent governance and assurance over technology compliance.
• Maintain compliance inventory and manage remediation efforts.
• Oversee adherence to IT Outsourcing Policy and manage cross-border risks.
• Validate effectiveness of IT controls and audit trails for sensitive information.
• Manage BCP/DR testing and ensure recovery objectives are met.

Job description

Job Requirements

Provide independent governance and assurance over the NBFC’s technology environment—separate from the IT line—to ensure end‑to‑end compliance with RBI IT Governance, Risk, Controls & Assurance Practices and RBI Outsourcing of IT Services directions, while aligning technology risk management to business objectives and risk appetite. This role reviews, challenges, and validates the effectiveness of IT controls, outsourcing practices (including cloud / SOC), and resilience measures.

Key Responsibilities

• Independent IT Governance Oversight
  • Operate as an independent checker over IT’s policies, standards, and controls; ensure the organization’s IT Governance Framework addresses strategic alignment, risk management, resource/performance management, and BCP/DR as required by RBI’s IT Master Directions, DPDP Act and other applicable regulations.
  • RBI Compliance
  • Maintain a compliance inventory and gap log, drive remediation with accountable owners in IT/InfoSec.
  • Establish and oversee (2LoD) adherence to a Board‑approved IT Outsourcing Policy.
  • Verify a central inventory of all IT outsourcing arrangements (materiality classification), due diligence, and contractual safeguards (audit & inspection rights, confidentiality & data protection, data residency/sovereignty, regulatory access, subcontracting controls, BCP/DR, exit/termination, SLA/OLA, performance & risk KRIs).
  • Ensure compliance with legacy and new agreements with specific compliance windows for renewals/new contracts.
  • Oversee cross‑border outsourcing risk assessments and controls; ensure cloud usage aligns with Appendix I (controls, location/sovereignty, monitoring) and SOC outsourcing aligns with Appendix II (governance, log ownership, response SLAs).
  • Change, Access & Ops Oversight (Non‑Execution)
  • Independently review change management artefacts (risk impact, approvals, testing, rollback, post‑implementation validations) and patch governance timeliness for critical vulnerabilities.
  • Check effectiveness of privileged access controls, SoD, recertifications, and teleworking controls per the Master Direction.
  • Validate the adequacy of audit trails/logging and monitoring for systems handling critical/sensitive information.
  • Review IS/Cyber policies, risk assessments, VA/PT cadence, and incident response/CCMP execution, including regulatory reporting readiness as per the Master Direction.
  • Track KRI/KCI thresholds for cyber/IT risks; elevate breaches per risk appetite to relevant authorities.
  • BCP/DR & Resilience Assurance
  • Oversee the BCP/DR testing calendar, scenario coverage, achievement of RPO/RTO as stipulated.

Work Experience

8–10 years