Vice President - Governance, Risk and Compliance Lead

SBI Payment Services Pvt. Ltd.; Gurugram District; On-site; INR 9,000,000 - 15,000,000; Full time

Benefits offered by this job

Health insurance

Wellness program

Annual health checkup

Job summary

SBI Card is seeking a Vice President - Governance, Risk & Compliance Lead to drive enterprise information security governance and risk management. The role requires building and maintaining GRC programs, policies, and controls across internal and third-party environments, aligned to regulatory requirements.

You will oversee risk assessments, audit engagements, and compliance with standards like ISO 27001, PCI-DSS, and NIST CSF, with a focus on strengthening SBIC's security posture and vendor

Qualifications

• Graduate in any discipline.
• Experience with ISMS frameworks and controls.
• Experience in governance, risk management and compliance.
• Ability to manage internal and third-party audits.

Responsibilities

• Develop GRC operating model and enterprise security policies.
• Operationalize security risk management, compliance, and policy programs.
• Lead third-party risk management and audit activities.
• Provide governance for information security aligned with regulatory requirements.

Skills

ISMS knowledge

ISO 27001

PCI-DSS

NIST CSF

CISA

CISM

CISSP

Vendor risk management

Audits

Education

Graduate in any discipline

Job description

Vice President - Governance, Risk & Compliance Lead

About Us

SBI Card is a leading pure-play credit card issuer in India, offering a wide range of credit cards to cater to diverse customer needs. We are constantly innovating to meet the evolving financial needs of our customers, empowering them with digital currency for seamless payment experience and indulge in rewarding benefits. At SBI Card, the motto 'Make Life Simple' inspires every initiative, ensuring that customer convenience is at the forefront of all that we do. We are committed to building an environment where people can thrive and create a better future for everyone. SBI Card is proud to be an equal opportunity & inclusive employer and welcome employees without any discrimination on the grounds of race, colour, gender, religion, creed, disability, sexual orientation, gender identity, marital status, caste etc. SBI Card is committed to fostering an inclusive and diverse workplace where all employees are treated equally with dignity and respect which makes it a promising place to work. Join us to shape the future of digital payment in India and unlock your full potential.

What’s in it for YOU

SBI Card truly lives by the work-life balance philosophy. We offer a robust wellness and wellbeing program to support mental and physical health of our employees Admirable work deserves to be rewarded. We have a well curated bouquet of rewards and recognition program for the employees Dynamic, Inclusive and Diverse team culture Gender Neutral Policy Inclusive Health Benefits for all - Medical Insurance, Personal Accidental, Group Term Life Insurance and Annual Health Checkup, Dental and OPD benefits Commitment to the overall development of an employee through comprehensive learning & development framework

Role Purpose

Responsible for ensuring appropriate information security governance within the internal and third party-controlled environments. The role is also responsible for supporting the enterprise control environment by ensuring compliance to Policies, procedures and other related documents are defined and updated , assuring Risks are identified and managed, applicable Controls are tested as per defined framework, Exceptions are recorded & remediated on-time, Control Data is analyzed and used for continuous improvement and optimization. InfoSec being a governance function for Risk Management, GRC lead is expected to manage First Party, Second Party and Third Party risk management activities & Internal/external audits per defined framework in accordance to regulatory requirement, under direction of CISO & ERM

Role Accountability

Develop GRC operating model and enterprise-wide security policies and operationalize various GRC capability areas such as enterprise security risk management, compliance management, policy management, security awareness training, third party risk management, and metrics and reporting Develop measures and metrics to evaluate the information security programs / Information Security Exception Management/ standards including ISO 27001, PCI-DSS, NIST CSF, COBIT etc. and modifies strategies as appropriate Lead the operationalization of security compliance programs to support various compliance regulations Perform risk assessments that address security threats, changes to systems and/or applications, process improvement initiatives, supplier assessments (including downstream outsourcers) and other requests from the business Maintain accurate reporting of remediation activities to bring appropriate visibility to stakeholders Monitor the security risk profiles of suppliers/ third party vendors to objectively determine high risk suppliers that require additional review Respond to customer security/compliance questionnaires Ensure policies, procedures, standards, and system configurations are documented, formally approved, published (including periodic reviews and updates) and communicated to all SBIC stakeholders Monitor the legal and regulatory environment for recent developments Provide Information Security Policy awareness training to SBIC employees, contractors and senior management team members, security operations team Oversees the planning, execution, and management of programs and projects related to compliance, control assurance, risk management, security, and infrastructure/information asset protection Work with third-party auditors to facilitate audits & compliance assessments Manage Information Security related risk for all the Vendor and Third Parties as part of the Vendor Risk Management Support audits and assessments conducted by both Internal stakeholders (Internal Audit, Compliance, Risk etc.) and external auditors (Regulator) Oversee process documentation and compliance adherence

Measures of Success

Timely and accurate Vendor Risk identification, remediation and closure Timely updation of infosec/cyber security policies in line with regulatory requirements Timely implementation of Agile security compliance programs Timely and accurate reporting of security, risk and compliance metrics for operational & executive management Increase in maturity of Information Security Matrix Timely identification, remediation & closure of gaps to stay compliant with regulatory requirements No adverse observations in internal/external audits Process Adherence as per MOU

Technical Skills / Experience / Certifications

Functional knowledge of ISMS domains and information security industry standard and best practices Sound knowledge of industry best practices and popular frameworks like ISO 27001:2013, COBIT, NIST and standards/regulations like PCI-DSS, RBI Extensive knowledge of information security management systems Good Documentation. Conducting internal assessments of IT Policies, Standards and Process compliance to IT Audit standards Risk-related industry-standard certifications such as CISA, CISM, CISSP would be a strong recommendation

Competencies critical to the role

Stakeholder Management Analytical Ability Influencing Skills Process Orientation Teamwork & Collaboration

Qualification

Graduate in any discipline

Preferred Industry

BFSI / NBFC /E-commerce/IT & ITES / Telecom

Experience Level

Executive Level