Lead - Integrated Risk Management

Key Result Areas

Supporting Actions

Operational Risk Framework Development

Implementation requires establishing comprehensive operational risk management frameworks aligned with RBI guidelines, conducting risk and control self-assessments (RCSA) across business units, developing risk appetite statements and key risk indicators (KRIs), and implementing continuous monitoring mechanisms for operational risk exposures.

Third-Party Risk Management (TPRM)

Conducting due diligence and risk assessments for new vendor onboarding, maintaining centralized third-party inventory with criticality classification, performing ongoing monitoring and periodic reassessments of vendor controls, ensuring contractual agreements include appropriate security and audit clauses, managing fourth-party dependencies and concentration risks, and coordinating vendor incident reporting and remediation tracking

Regulatory Compliance and Audit Coordination

Encompasses leading regulatory audits from RBI, SEBI, IRDAI, NPCI, AMFI and other authorities, ensuring timely compliance with regulatory circulars and master directions, coordinating evidence collection and documentation for examinations, tracking audit observations and driving timely closure with control owners, and maintaining compliance monitoring programs for BFSI-specific requirements.

Enterprise Risk Assessment and Reporting

Conducting enterprise-wide risk assessments across operational, technology, compliance, and strategic risk domains, preparing aggregated risk reports and dashboards for senior management and Board Risk Committee, identifying emerging risks and escalating material risk exposures, facilitating risk committee meetings and maintaining meeting documentation, and ensuring integration of risk considerations into business decision-making processes.

Governance Structure and Policy Management

Requires developing and maintaining risk management policies, standards, and procedures, ensuring board-approved governance frameworks are implemented effectively, providing effective challenge to first line of defense on risk-taking activities, conducting risk awareness and training programs for business units, and ensuring alignment with Enterprise Risk Management Framework and Three Lines of Defense model.

Business Continuity and Operational Resilience

Involves assessing operational resilience across critical business services, developing business continuity plans and disaster recovery strategies, conducting stress testing and scenario analysis for operational disruptions, ensuring third-party service providers have adequate continuity arrangements, and coordinating crisis management protocols and incident response procedures

Data Privacy and Cybersecurity Risk Oversight

Ensuring compliance with data protection regulations (DPDP Act, GDPR where applicable), conducting information security risk assessments for systems and applications, reviewing and monitoring data loss prevention (DLP) and access control policies, coordinating cybersecurity incident monitoring and response, and ensuring cloud security and API security controls are adequately implemented