IT Risk & Compliance Manager

We are seeking an experienced IT Risk & Compliance Manager to oversee IT Risk Management, IT Governance, Information Security, and Regulatory Compliance across the organization. The role will ensure alignment with regulatory expectations (including RBI), industry standards, and internal governance frameworks while working closely with IT leadership, Risk, Audit, and Compliance teams.

Key Roles & Responsibilities

• Lead and manage IT Risk Management, IT Governance, Information Security (IS), and Compliance functions across the organization.
• Identify, assess, and mitigate IT and cybersecurity risks, ensuring effective and sustainable control measures.
• Perform IT General Controls (ITGC) and IT Application Controls (ITAC) testing for business-critical applications.
• Identify control gaps and ensure timely remediation of issues within agreed timelines.
• Develop, review, update, and maintain IT & Information Security policies, procedures, and standards in line with regulatory and business requirements.
• Track and ensure closure of audit, risk, and compliance observations raised by internal/external audits and regulatory inspections.
• Review IT audit, IS audit, and regulatory inspection reports (including RBI) and incorporate findings into ongoing testing and monitoring plans.
• Maintain comprehensive IT governance, risk, and audit documentation as per regulatory standards.
• Review vendor and third-party agreements for contractual, regulatory, and information security compliance.
• Conduct end-to-end walkthroughs and negative testing of business-critical applications in controlled environments.
• Define and track IT governance KPIs, KRIs, KCIs, and compliance metrics for management reporting.
• Advise stakeholders on interpretation and implementation of IT and IS policies and frameworks.
• Integrate KRI/KCI monitoring with the enterprise IT risk management framework.
• Collaborate with CTO, CISO, Risk, Audit, and Compliance teams to strengthen governance and control frameworks.
• Provide guidance on designing and enhancing IT and security controls aligned with organizational and regulatory standards.

Mandatory Skills & Competencies

• Strong experience with Information Security Management Systems (ISMS) and related frameworks.
• Hands-on expertise in IT Risk Management methodologies, risk assessments, and mitigation planning.
• Solid understanding of IT, Information Security, and Cybersecurity risks.
• Proven experience in conducting or managing IT and IS audits and closing audit observations.
• Ability to manage risks in a dynamic, technology-driven environment.
• Good understanding of Indian regulatory requirements, especially RBI guidelines and IT security standards.

Qualifications

• Experience: 4 to 6 years in IT / Information Security Governance, Risk, and Compliance.
  Experience in NBFCs, Banks, or BFSI organizations is strongly preferred.
• Education: Bachelors degree in IT / Computer Science.
  MBA with IT specialization preferred.
• Framework Knowledge: Strong working knowledge of ISO 27001, COBIT, COSO, NIST, CSA frameworks.
• Certifications (Preferred): ISO 27001, CISM, COBIT, or other relevant IT/IS certifications.