Manager - GRC

LeadSquared

Skills

Own end-to-end ISO 27001:2022, SOC 2 Type 2, HIPAA, privacy, BFSI, and ISO/IEC 42001 programs, including readiness, internal audits, management reviews, external assessments, evidence, dashboards, and remediation.
Operationalize GDPR, CCPA, DPDP Act, RBI, SEBI, and IRDAI requirements, including data mapping, DPIAs, ROPA , retention, cross-border transfers, localization, outsourcing, and breach notifications.
Maintain policies, standards, exceptions, risk registers, and assessments covering security, privacy, third parties, AWS/cloud, SDLC, DevOps, applications, and AI; track owners, mitigation, residual risk, approvals, and closure.
Build and improve an ISO/IEC 42001-aligned AI Management System, including use-case inventories, impact and risk assessments, responsible-AI controls, vendor reviews, human oversight, monitoring, and evidence.
Lead customer RFIs/RFPs, security and privacy questionnaires, audits, and customer discussions; coordinate Security, IT, Engineering, Product, Legal, Privacy, HR, Customer Success, auditors, and regulators.
Oversee incident compliance, RCA/CAPA, vendor risk, awareness and phishing programs, GRC automation, regulatory tracking, control monitoring, reporting, and continuous maturity improvements; mentor team members.
Perform AI driven compliance automation Qualifications 7 –10 years in information security GRC, audit, risk, and privacy, with proven ownership of enterprise compliance programs.

Multiple end-to-end ISO 27001:2022 and SOC 2 Type 2 audit cycles; privacy compliance (GDPR, CCPA, DPDP Act); BFSI regulations (RBI, SEBI, IRDAI); SDLC/DevOps and AWS risk assessments; and customer security/privacy RFI responses.
Strong knowledge of OWASP Top 10 cloud , application and AI security risks , incident management, third-party risk, and experience in GRC/compliance-automation platforms such as Sprinto , AuditBoard , Drata , etc.
Mandatory w orking knowledge of AI governance, including lifecycle risk, data quality, monitoring, fairness, explainability, transparency, accountability, human oversight, and third-party AI risk.
Bachelor’s degree in Information Security, Computer Science, or related field; Master’s preferred.
Strong analytical, communication, stakeholder-management, leadership, and mentoring skills.

Certifications such as ISO 27001 Lead Auditor/Implementer, CISA, CISM, or CISSP preferred; ISO/IEC 42001 and privacy certifications are advantageous.