Cyber GRC and Privacy Lead

Responsibilities:

• Governance, Risk and Compliance (GRC): Manage and execute the organization's cybersecurity governance, risk, and compliance initiatives. Continuously improve policies, control frameworks, and operational procedures to ensure alignment with ISO/IEC 27001:2022, the India DPDP Act, and relevant CERT-In, RBI, or SEBI guidelines.
• Risk Assessments: Conduct comprehensive, enterprise-wide cyber risk assessments, tracking vulnerabilities and managing the risk treatment and mitigation lifecycle.
• Audit and Assurance: Coordinate internal and external security audits, control walkthroughs, and security assessments. Own evidence collection management and drive the timely remediation of any discovered compliance gaps.
• Third-Party Risk Management (TPRM): Lead the end-to-end vendor security risk assessment process, evaluating the security postures of cloud infrastructure, SaaS platforms, and third-party technology partners via detailed risk scoring.
• Enterprise Security Collaboration: Partner closely with DevOps, Infrastructure, and
• Security Operations teams to ensure data protection, secure access management, and incident response requirements are systematically embedded into our cloud native workflows.
• Reporting and Culture: Provide clear cybersecurity metrics, compliance dashboards, and risk exception tracking to leadership while driving a proactive security awareness culture across the team.

Requirements:

• Experience: 5 to 10 years of strong, hands-on experience spanning Information Security, Cyber GRC, IT Audit, and Privacy frameworks.
• Compliance Frameworks: Direct expertise managing ISO 27001 certifications, control testing, and data privacy mandates (specifically the India DPDP Act).
• Security and Infrastructure Knowledge: Solid comprehension of cloud security principles (AWS preferred), SaaS environments, modern infrastructure setups, and general IT controls (ITGC). Familiarity with NIST CSF or NIST SP 800-53 standards.
• Stakeholder Management: Exceptional communication, documentation, and presentation skills, with the ability to clearly break down technical risks for cross-functional stakeholders.
• Preferred Certifications: Holding one or more relevant certifications is highly preferred (e. g., CISA, CISM, CISSP, CDPSE, or ISO 27001 Lead Auditor/Implementer).

Good to Have:

• Prior enterprise security operational background (such as SecOps or infrastructure hardening) before moving into a specialised GRC track.
• Experience working inside highly regulated spaces like crypto exchanges, fintech platforms, digital wallets, or digital banking systems.
• Familiarity with blockchain concepts, wallet security, and unique regulatory interactions inside the digital asset domain.