Lead - IT Governance

Job Summary

Provide independent governance and assurance over the NBFC's technology environment-separate from the IT line-to ensure end-to-end compliance with RBI IT Governance, Risk, Controls Assurance Practices and RBI Outsourcing of IT Services directions, while aligning technology risk management to business objectives and risk appetite. This role reviews, challenges, and validates the effectiveness of IT controls, outsourcing practices (including cloud / SOC), and resilience measures.

Responsibilities

• Independent IT Governance Oversight. Operate as an independent checker over IT's policies, standards, and controls; ensure the organization's IT Governance Framework addresses strategic alignment, risk management, resource/performance management, and BCP/DR as required by RBI's IT RBI Master Directions, DPDP Act and other applicable regulations.
• RBI Compliance.
  • Maintain a compliance inventory and gap log, drive remediation with accountable owners in IT/InfoSec.
  • Establish and oversee (2LoD) adherence to a Board-approved IT Outsourcing Policy.
  • Verify a central inventory of all IT outsourcing arrangements (materiality classification), due diligence, and contractual safeguards (audit inspection rights, confidentiality data protection, data residency/sovereignty, regulatory access, subcontracting controls, BCP/DR, exit/termination, SLA/OLA, performance risk KRIs).
  • Ensure compliance with legacy and new agreements with specific compliance windows for renewals/new contracts).
  • Oversee cross-border outsourcing risk assessments and controls; ensure cloud usage aligns with Appendix I (controls, location/sovereignty, monitoring) and SOC outsourcing aligns with Appendix II (governance, log ownership, response SLAs).
  • Change, Access Ops Oversight (Non-Execution).
  • Independently review change management artefacts (risk impact, approvals, testing, rollback, post-implementation validations) and patch governance timeliness for critical vulnerabilities.
  • Check effectiveness of privileged access controls, SoD, recertifications, and teleworking controls per the Master Direction.
  • Validate the adequacy of audit trails/logging and monitoring for systems handling critical/sensitive information.
  • Review IS/Cyber policies, risk assessments, VA/PT cadence, and incident response/CCMP execution, including regulatory reporting readiness as per the Master Direction.
  • Track KRI/KCI thresholds for cyber/IT risks; escalate breaches per risk appetite to relevant authorities.
  • BCP/DR Resilience Assurance.
  • Oversee the BCP/DR testing calendar, scenario coverage, achievement of RPO/RTO as stipulated.

Experience

Work Experience: 8+ years.

Job Type

Full-time

Location

Mumbai, Maharashtra, India

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.