Manager - GRC

LeadSquared; Bengaluru; On-site; INR 4,000,000 - 7,000,000; Full time

Job summary

LeadSquared seeks a senior Information Security GRC leader to drive ISO 27001:2022, SOC 2 Type 2, privacy and AI governance programs. You will own readiness, audits, evidence, and remediation while coordinating across Security, IT, Engineering, Legal, Privacy, and Regulators.

The role requires delivering compliance across GDPR, CCPA, DPDP Act, RBI/SEBI/IRDAI, and cloud risk, with a focus on AI governance, controls, and vendor risk management.

Qualifications

• End-to-end ISO 27001:2022 and SOC 2 Type 2 audit cycles.
• Privacy compliance (GDPR, CCPA, DPDP Act) and BFSI regulations.
• SDLC/DevOps and AWS risk assessments.
• AI governance lifecycle and risk controls.

Responsibilities

• Own end-to-end ISO 27001:2022, SOC 2 Type 2, HIPAA, privacy, BFSI, and ISO/IEC 42001 programs; readiness, audits, evidence, remediation.
• Operationalize GDPR, CCPA, DPDP Act, RBI, SEBI, IRDAI requirements, including mapping, DPIAs, retention, cross-border transfers.
• Maintain policies, standards, risk registers, and assessments across security, privacy, vendors, AWS, SDLC, DevOps, and AI.
• Build ISO/IEC 42001-aligned AI Management System with usage inventories, risk assessments, and human oversight.
• Lead RFIs/RFPs, security/privacy questionnaires, audits, and regulator communications; coordinate across functions.
• Oversee incident compliance, RCA/CAPA, vendor risk, GRC automation, and continuous maturity improvements.

Skills

GRC governance

Audits & governance

Risk management

Privacy compliance

Stakeholder management

Leadership & mentoring

Communication

Education

Bachelor's in Information Security

Bachelor's in Computer Science

Master's degree preferred

ISO 27001 Lead Auditor/Implementer

CISA

CISM

CISSP

ISO/IEC 42001 privacy certifications

Tools

Sprinto

AuditBoard

Drata

Job description

D rive LeadSquared’s information security, privacy, BFSI regulatory, and AI governance compliance program. This senior, hands-on role leads audits, risk and control governance, customer assurance, policy management, evidence readiness, and cross-functional coordination across ISO 27001:2022, SOC 2 Type 2, HIPAA, GDPR, CCPA, DPDP Act, RBI, SEBI, IRDAI , and ISO/IEC 42001 .

Key Responsibilities

• Compliance & audits: Own end-to-end ISO 27001:2022, SOC 2 Type 2, HIPAA, privacy, BFSI, and ISO/IEC 42001 programs, including readiness, internal audits, management reviews, external assessments, evidence, dashboards, and remediation.
• Privacy & regulatory: Operationalize GDPR, CCPA, DPDP Act, RBI, SEBI, and IRDAI requirements, including data mapping, DPIAs, ROPA , retention, cross-border transfers, localization, outsourcing, and breach notifications.
• Policy & risk governance: Maintain policies, standards, exceptions, risk registers, and assessments covering security, privacy, third parties, AWS/cloud, SDLC, DevOps, applications, and AI; track owners, mitigation, residual risk, approvals, and closure.
• AI governance: Build and improve an ISO/IEC 42001-aligned AI Management System, including use-case inventories, impact and risk assessments, responsible-AI controls, vendor reviews, human oversight, monitoring, and evidence.
• Assurance & stakeholders: Lead customer RFIs/RFPs, security and privacy questionnaires, audits, and customer discussions; coordinate Security, IT, Engineering, Product, Legal, Privacy, HR, Customer Success, auditors, and regulators.
• Operations & improvement: Oversee incident compliance, RCA/CAPA, vendor risk, awareness and phishing programs, GRC automation, regulatory tracking, control monitoring, reporting, and continuous maturity improvements; mentor team members. Perform AI driven compliance automation

Qualifications

• 7 –10 years in information security GRC, audit, risk, and privacy, with proven ownership of enterprise compliance programs.
• Mandatory: Multiple end-to-end ISO 27001:2022 and SOC 2 Type 2 audit cycles; privacy compliance (GDPR, CCPA, DPDP Act); BFSI regulations (RBI, SEBI, IRDAI); SDLC/DevOps and AWS risk assessments; and customer security/privacy RFI responses.
• Strong knowledge of OWASP Top 10 cloud , application and AI security risks , incident management, third-party risk, and experience in GRC/compliance-automation platforms such as Sprinto , AuditBoard , Drata , etc.
• Mandatory w orking knowledge of AI governance, including lifecycle risk, data quality, monitoring, fairness, explainability, transparency, accountability, human oversight, and third-party AI risk.
• Bachelor’s degree in Information Security, Computer Science, or related field; Master’s preferred. Certifications such as ISO 27001 Lead Auditor/Implementer, CISA, CISM, or CISSP preferred; ISO/IEC 42001 and privacy certifications are advantageous.
• Strong analytical, communication, stakeholder-management, leadership, and mentoring skills.