Manager - GRC

LeadSquared; Bengaluru; Vor Ort; INR 2.200.000 - 3.600.000; Vollzeit

Zusammenfassung

LeadSquared seeks a senior information security GRC leader to own compliance across ISO 27001:2022, SOC 2 Type 2, HIPAA, GDPR, CCPA, and DPDP Act, with focus on RBI, SEBI, IRDAI requirements. You will drive readiness, audits, and evidence across the organization.

The role requires coordinating across Security, IT, Engineering, Legal, Privacy and adjacent teams while maturing AI governance and risk controls; strong leadership and mentoring skills are a must.

Qualifikationen

• 7–10 years in information security GRC, audit, risk, and privacy, with proven ownership of enterprise compliance programs.
• Mandatory: Multiple end-to-end ISO 27001:2022 and SOC 2 Type 2 audit cycles; privacy compliance (GDPR, CCPA, DPDP Act); BFSI regulations (RBI, SEBI, IRDAI); SDLC/DevOps and AWS risk assessments; and customer security/privacy RFI responses.
• Strong knowledge of OWASP Top 10 cloud, application and AI security risks, incident management, third-party risk, and experience in GRC/compliance-automation platforms such as Sprinto , AuditBoard , Drata , etc.
• Mandatory w working knowledge of AI governance, including lifecycle risk, data quality, monitoring, fairness, explainability, transparency, accountability, human oversight, and third-party AI risk.
• Bachelor's degree in Information Security, Computer Science, or related field; Masters preferred. Certifications such as ISO 27001 Lead Auditor/Implementer, CISA, CISM, or CISSP preferred; ISO/IEC 42001 and privacy certifications are advantageous.
• Strong analytical, communication, stakeholder-management, leadership, and mentoring skills.

Aufgaben

• Compliance & audits: Own end-to-end ISO 27001:2022, SOC 2 Type 2, HIPAA, privacy, BFSI, and ISO/IEC 42001 programs, including readiness, internal audits, management reviews, external assessments, evidence, dashboards, and remediation.
• Privacy & regulatory: Operationalize GDPR, CCPA, DPDP Act, RBI, SEBI, and IRDAI requirements, including data mapping, DPIAs, ROPA, retention, cross-border transfers, localization, outsourcing, and breach notifications.
• Policy & risk governance: Maintain policies, standards, exceptions, risk registers, and assessments covering security, privacy, third parties, AWS/cloud, SDLC, DevOps, applications, and AI; track owners, mitigation, residual risk, approvals, and closure.
• AI governance: Build and improve an ISO/IEC 42001-aligned AI Management System, including use-case inventories, impact and risk assessments, responsible-AI controls, vendor reviews, human oversight, monitoring, and evidence.
• Assurance & stakeholders: Lead customer RFIs/RFPs, security and privacy questionnaires, audits, and customer discussions; coordinate Security, IT, Engineering, Product, Legal, Privacy, HR, Customer Success, auditors, and regulators.
• Operations & improvement: Oversee incident compliance, RCA/CAPA, vendor risk, awareness and phishing programs, GRC automation, regulatory tracking, control monitoring, reporting, and continuous maturity improvements; mentor team members. Perform AI driven compliance automation.

Kenntnisse

Information security

GRC

Audit

Privacy

Regulatory compliance

Ausbildung

Bachelor's degree in Information Security or Computer Science

Master's degree preferred

Tools

Sprinto

AuditBoard

Drata

Jobbeschreibung

Position Overview

Drive LeadSquareds information security, privacy, BFSI regulatory, and AI governance compliance program. This senior, hands-on role leads audits, risk and control governance, customer assurance, policy management, evidence readiness, and cross-functional coordination across ISO 27001:2022, SOC 2 Type 2, HIPAA, GDPR, CCPA, DPDP Act, RBI, SEBI, IRDAI, and ISO/IEC 42001.

Key Responsibilities

• Compliance & audits: Own end-to-end ISO 27001:2022, SOC 2 Type 2, HIPAA, privacy, BFSI, and ISO/IEC 42001 programs, including readiness, internal audits, management reviews, external assessments, evidence, dashboards, and remediation.
• Privacy & regulatory: Operationalize GDPR, CCPA, DPDP Act, RBI, SEBI, and IRDAI requirements, including data mapping, DPIAs, ROPA, retention, cross-border transfers, localization, outsourcing, and breach notifications.
• Policy & risk governance: Maintain policies, standards, exceptions, risk registers, and assessments covering security, privacy, third parties, AWS/cloud, SDLC, DevOps, applications, and AI; track owners, mitigation, residual risk, approvals, and closure.
• AI governance: Build and improve an ISO/IEC 42001-aligned AI Management System, including use-case inventories, impact and risk assessments, responsible-AI controls, vendor reviews, human oversight, monitoring, and evidence.
• Assurance & stakeholders: Lead customer RFIs/RFPs, security and privacy questionnaires, audits, and customer discussions; coordinate Security, IT, Engineering, Product, Legal, Privacy, HR, Customer Success, auditors, and regulators.
• Operations & improvement: Oversee incident compliance, RCA/CAPA, vendor risk, awareness and phishing programs, GRC automation, regulatory tracking, control monitoring, reporting, and continuous maturity improvements; mentor team members. Perform AI driven compliance automation.

Qualifications

• 7 10 years in information security GRC, audit, risk, and privacy, with proven ownership of enterprise compliance programs.
• Mandatory: Multiple end-to-end ISO 27001:2022 and SOC 2 Type 2 audit cycles; privacy compliance (GDPR, CCPA, DPDP Act); BFSI regulations (RBI, SEBI, IRDAI); SDLC/DevOps and AWS risk assessments; and customer security/privacy RFI responses.
• Strong knowledge of OWASP Top 10 cloud , application and AI security risks , incident management, third-party risk, and experience in GRC/compliance-automation platforms such as Sprinto , AuditBoard , Drata , etc.
• Mandatory w working knowledge of AI governance, including lifecycle risk, data quality, monitoring, fairness, explainability, transparency, accountability, human oversight, and third-party AI risk.
• Bachelors degree in Information Security, Computer Science, or related field; Masters preferred. Certifications such as ISO 27001 Lead Auditor/Implementer, CISA, CISM, or CISSP preferred; ISO/IEC 42001 and privacy certifications are advantageous.
• Strong analytical, communication, stakeholder-management, leadership, and mentoring skills.