GRC Manager

Key Result Areas

Supporting Actions

Regulatory & Compliance Audits for Payments

• Lead and coordinate paymentindustry regulatory audits such as RBI, NPCI, PCIDSS, , CERTIN, etc.
• Manage endtoend audit activities including audit calendar management, documentation preparation, evidence collection, and stakeholder coordination.
• Track audit observations/findings and ensure timely closure with respective control owners.
  
  

Regulatory compliances

• Identify all regulatory compliance requirements.
• Review and update the policies to ensure identified regulatory requirements are drafted in policies.
• Conduct the assessments to ensure implemented controls are meeting to regulatory compliances.
  
  

Data Loss Prevention (DLP) & Proxy Governance

• Review, implement, and maintain DLP and Proxy policies across the organization.
• Perform DLP and Proxy exception reviews, ensuring justification, approval, and tracking.
• Conduct ongoing monitoring and analysis of High and Medium severity DLP incidents.
• Collaborate with IT/security teams to finetune policies and reduce false positives.
  
  

Control Validation & Compliance Monitoring

• Perform control validation to ensure compliance with internal policies, procedures, and regulatory guidelines.
• Execute periodic checks on access management, data protection controls, endpoint security, and network controls.
• Document deviations and drive corrective action plans with respective teams.
  
  

Conduct Third-Party risk assessments

• Understand the business requirement from proposed solution, connect with the vendor and functional/data/IT SPOCs to understand the architecture of the proposed solution's integration and data movement
• Conduct the InfoSec/cyber risk assessment to identify InfoSec/cyber related risks and regulatory requirement's compliance
• Submit the risk assessment report to concern stakeholders with highlighting residual InfoSec/cyber risks and provide mitigation recommendation for the same
• Track with businesses to ensure that recommendations are accepted and implemented and if it is not then risk is accepted for the same
• Track Open vendor's risks at ABC level and along with recommended controls to mitigate the risk
• Present risk to concern team and ABCD CISO senior management for their knowledge and support
• Review the MSA/NDA and making sure that the required Information Security clauses such as Information Security and Data Protection, Data Purging requirements, Right to Audit clause, SLA, Penalty etc., are prepared