Manager - GRC

Gramax; Gurugram District; On-site; INR 6,000,000 - 9,000,000; Full time

Job summary

Gramax in Gurugram is seeking a senior Cyber Security & GRC leader to own enterprise risk management, governance, and data protection across the organization. You will oversee risk assessments, regulatory alignment, and executive reporting to CXOs and the board.

You will manage audits, incident response, continuous control monitoring, and policy lifecycle, while guiding third‑party risk and security culture to safeguard the brand.

Responsibilities

• Own enterprise cyber risk management, identifying, assessing, prioritizing and mitigating risks.
• Lead governance frameworks aligned with ISO 27001, NIST, COBIT, SOC 1/2 and GDPR.
• Oversee data protection strategy including privacy by design and regulatory compliance.
• Manage internal and external audits for SOC 1/2, ISO 27001 and other standards.
• Drive continuous control monitoring, KPI dashboards and risk reporting.
• Engage CXOs, Board, clients and regulators with clear risk posture and recommendations.
• Align GRC initiatives with business strategy and digital transformation goals.
• Oversee multiple GRC programs and mentor junior analysts.
• Lead policy lifecycle and regulatory intelligence; guide incident response and post‑incident improvements.
• Oversee third‑party risk governance and vendor security requirements.
• Promote cybersecurity awareness and build a risk‑aware culture.

Job description

Department / Sub-Department: Cyber Security

1. Key Accountabilities

• Enterprise Cyber Risk Management: Provide strategic leadership in identifying, assessing, prioritizing, and mitigating cyber, technology, and privacy risks across the enterprise. Own the cyber risk framework and ensure integration with enterprise risk management (ERM). Lead complex risk assessments, threat modeling, and risk quantification initiatives.
• Security Governance & Compliance Leadership: Design, implement, and oversee enterprise-wide governance frameworks aligned with global standards (ISO 27001, NIST, COBIT, SOC 1/2, GDPR, DPDP, etc.). Ensure policies, standards, and procedures are consistently implemented and enforced.
• Data Protection & Privacy Oversight: Lead data protection strategy including data classification, access control governance, privacy‑by‑design initiatives, and regulatory compliance. Act as a senior advisor on privacy risk, breach prevention, and regulatory exposure.
• Audit & Certification Management: Own and lead internal and external audits for certifications such as SSAE18 SOC 1, SOC 2, ISO 27001, and other regulatory or customer‑driven audits. Interface directly with auditors and executive leadership.
• Continuous Control Monitoring & Assurance: Oversee continuous monitoring programs to evaluate control effectiveness, maturity, and resilience. Drive automation of GRC metrics and reporting dashboards.
• Executive & Client Stakeholder Engagement: Act as a trusted advisor to CXOs, Board members, clients, and regulators. Present risk posture, compliance status, and strategic recommendations clearly and concisely.
• Strategic Organizational Contribution: Align GRC initiatives with organizational strategy, business growth, and digital transformation goals. Safeguard brand value and support revenue enablement through trust and compliance assurance.
• Program & Portfolio Management: Oversee multiple high‑impact GRC initiatives simultaneously. Provide mentorship to junior analysts and ensure delivery excellence across all GRC programs.
• Policy Architecture & Regulatory Intelligence: Lead policy lifecycle management, ensuring alignment with evolving regulatory requirements, industry standards, and emerging threat landscapes.
• Incident Response & Crisis Management Support: Provide senior‑level guidance during cybersecurity incidents, breaches, and crisis events. Lead post‑incident analysis and continuous improvement initiatives.
• Advanced Risk Reporting & Analytics: Deliver executive‑level dashboards, risk heatmaps, trend analyses, and actionable insights to support decision‑making at the Board and CXO level.
• Vendor & Third‑Party Risk Governance: Lead third‑party risk management (TPRM) including due diligence, ongoing monitoring, and contractual security requirements for vendors and partners.
• Enterprise Training & Security Culture Development: Sponsor and guide organization‑wide cybersecurity awareness and executive training programs to build a strong risk‑aware culture.