Vice President – Governance Risk & Compliance Lead

SBI Card; Gurugram District; On-site; INR 1,800,000 - 2,800,000; Full time

Job summary

SBI Card is seeking a GRC Lead to ensure information security governance across internal and third-party environments. You will support the enterprise control framework, manage risk through policy updates, controls testing, and remediation, and oversee audits with directives from the CISO & ERM.

Responsibilities include leading enterprise security risk management, third-party risk oversight, and compliance programs across ISO 27001, PCI-DSS, NIST CSF and COBIT.

Qualifications

• Graduate in any discipline.
• ISMS domain knowledge and security best practices.
• Experience with ISO 27001, COBIT, NIST, PCI-DSS, RBI frameworks.
• Certifications such as CISA, CISM, CISSP recommended.

Responsibilities

• Develop and manage GRC operating model and enterprise security policies.
• Operationalize security compliance programs across regulatory requirements.
• Perform risk assessments addressing threats, changes, and supplier assessments.
• Maintain accurate remediation reporting and visibility to stakeholders.
• Monitor supplier risk profiles and high-risk vendors for review.
• Coordinate audits and compliance assessments with internal and external auditors.
• Document and publish policies, standards, and configurations; ensure periodic reviews.

Skills

Stakeholder Management

Analytical Ability

Process Orientation

Education

Graduate in any discipline

Job description

Role Purpose: Responsible for ensuring appropriate information security governance within the internal and third party-controlled environments. The role is also responsible for supporting the enterprise control environment by ensuring compliance to Policies, procedures and other related documents are defined and updated , assuring Risks are identified and managed, applicable Controls are tested as per defined framework, Exceptions are recorded & remediated on-time, Control Data is analyzed and used for continuous improvement and optimization. InfoSec being a governance function for Risk Management, GRC lead is expected to manage First Party, Second Party and Third Party risk management activities & Internal/external audits per defined framework in accordance to regulatory requirement, under direction of CISO & ERM

Role Accountability

• Develop GRC operating model and enterprise-wide security policies and operationalize various GRC capability areas such as enterprise security risk management, compliance management, policy management, security awareness training, third party risk management, and metrics and reporting
• Develop measures and metrics to evaluate the information security programs / Information Security Exception Management/ standards including ISO 27001, PCI-DSS, NIST CSF, COBIT etc. and modifies strategies as appropriate
• Lead the operationalization of security compliance programs to support various compliance regulations
• Perform risk assessments that address security threats, changes to systems and/or applications, process improvement initiatives, supplier assessments (including downstream outsourcers) and other requests from the business
• Maintain accurate reporting of remediation activities to bring appropriate visibility to stakeholders
• Monitor the security risk profiles of suppliers/ third party vendors to objectively determine high risk suppliers that require additional review
• Respond to customer security/compliance questionnaires
• Ensure policies, procedures, standards, and system configurations are documented, formally approved, published (including periodic reviews and updates) and communicated to all SBIC stakeholders
• Monitor the legal and regulatory environment for recent developments
• Provide Information Security Policy awareness training to SBIC employees, contractors and senior management team members, security operations team
• Oversees the planning, execution, and management of programs and projects related to compliance, control assurance, risk management, security, and infrastructure/information asset protection
• Work with third-party auditors to facilitate audits & compliance assessments
• Manage Information Security related risk for all the Vendor and Third Parties as part of the Vendor Risk Management
• Support audits and assessments conducted by both Internal stakeholders (Internal Audit, Compliance, Risk etc.) and external auditors (Regulator)
• Oversee process documentation and compliance adherence

Measures of Success

• Timely and accurate Vendor Risk identification, remediation and closure
• Timely updation of infosec/cyber security policies in line with regulatory requirements
• Timely implementation of Agile security compliance programs
• Timely and accurate reporting of security, risk and compliance metrics for operational & executive management
• Increase in maturity of Information Security Matrix
• Timely identification, remediation & closure of gaps to stay compliant with regulatory requirements
• No adverse observations in internal/external audits
• Process Adherence as per MOU

Technical Skills / Experience / Certifications

• Functional knowledge of ISMS domains and information security industry standard and best practices
• Sound knowledge of industry best practices and popular frameworks like ISO 27001:2013, COBIT, NIST and standards/regulations like PCI-DSS, RBI
• Extensive knowledge of information security management systems
• Good Documentation. Conducting internal assessments of IT Policies, Standards and Process compliance to IT Audit standards
• Risk-related industry-standard certifications such as CISA, CISM, CISSP would be a strong recommendation

Competencies critical to the role

• Stakeholder Management
• Analytical Ability
• Process Orientation

Qualification

Graduate in any discipline

Preferred Industry

BFSI / NBFC /E-commerce/IT & ITES / Telecom