Assistant Vice President IT GRC
Posted Updated
Description
Designation
Location
Function
Role Level
Role Type
Experience Level
Assistant Vice President IT GRC
Mumbai
Information Security / Technology Risk Governance
Senior Management
Governance, Risk, Compliance, Regulatory Assurance Cyber Resilience
Minimum 10 yrs relevant experience
1. Role Purpose
2. Key Responsibilities
A. IT Governance Policy Oversight
B. Regulatory Compliance SEBI Governance
C. Enterprise IT Cyber Risk Management
D. Audit, Assurance Certification Management
Provide senior-level governance and coordination for:
E. Cyber Resilience, BCP DR Governance
F. Cybersecurity Regulatory Framework
G. Third-Party / Vendor Risk Management
H. Management Governance Committee Reporting
I. Security Awareness GRC Culture
3. Qualifications Experience
Professional Certifications
One or more relevant certifications would be desirable, for example:
Experience
4. Critical Competencies
Domain Competencies
Leadership Competencies
The AVP IT GRC is responsible for providing leadership and oversight for the organizations IT governance, technology and cyber risk management, regulatory compliance, assurance, cyber resilience and management reporting framework.
- Lead the IT/Information Security GRC governance framework and ensure alignment with organizational objectives, regulatory expectations and risk appetite.
- Oversee periodic review and lifecycle management of IT, Information Security, Cybersecurity and related policies, standards, procedures and SOPs.
- Ensure regulatory requirements are appropriately translated into policies, control requirements and accountable implementation actions.
- Establish appropriate governance mechanisms for tracking policy deviations, exceptions and remediation actions.
- Drive consistency between policies, operating procedures, actual controls and audit/regulatory evidence.
- Lead assessment of regulatory circulars, advisories and directions affecting IT, cybersecurity, operational resilience and technology risk.
- Perform/oversee regulatory applicability and gap assessments and establish accountable action plans for identified gaps.
- Coordinate major regulatory submissions relating to areas such as:
- Cybersecurity
- System and Network Audit
- VAPT
- Red Team assessments
- IT Cyber Risk Assessments
- Cloud
- AI/ML
- CCI/SOC efficacy
- Technical glitches and cyber incidents
- Coordinate regulatory inspections, including PIQ responses, evidence collation, stakeholder reviews and closure tracking.
- Coordinate communications with applicable authorities and ecosystem stakeholders.
- Provide oversight of enterprise IT and cybersecurity risk assessment programmes.
- Ensure technology risks are identified based not only on regulatory compliance but also on actual threat, business and technology context.
- Maintain management visibility over material risks, control gaps, accepted risks and remediation plans.
- Challenge risk assessments and ensure mitigation plans are proportionate to business and technology exposure.
- Integrate emerging technology risks, including cloud and AI-related risks, into the technology risk-management framework.
- Cybersecurity audits
- System and Network audits
- ITGC audits
- IT Cyber Risk assessments
- ISO 27001
- ISO 22301
- ISO 9001, where applicable
- CCI/SOC efficacy assessments
- Internal and external assurance exercises
- Regulatory inspection requirements
- Provide governance oversight for cyber resilience, business continuity and disaster recovery requirements.
- Review resilience risks, BCP/DR controls, risk assessments and supporting evidence.
- Ensure identified resilience gaps are appropriately escalated and tracked.
- Support alignment of resilience practices with applicable regulatory requirements.
- Oversee governance of resilience testing and management reporting.
- Provide governance oversight over compliance with the applicable Cyber Security and Cyber Resilience Framework and related requirements.
- Monitor major compliance gaps and implementation programmes.
- Ensure critical cybersecurity risks, control weaknesses and recurring observations receive appropriate management attention.
- Coordinate assurance and reporting requirements supporting cybersecurity maturity and resilience.
- Provide governance oversight over technology and cybersecurity risks associated with third parties and service providers.
- Ensure risk-based due diligence is undertaken for relevant vendors.
- Monitor significant third-party control gaps and remediation actions.
- Coordinate with IT, procurement, business, legal and Information Security stakeholders on vendor-risk requirements.
- Ensure third-party cybersecurity and resilience risks are incorporated into the overall GRC framework.
- Provide senior management with a consolidated view of technology, cybersecurity, compliance and operational-resilience risks.
- Prepare and review management and governance committee papers.
- Present material risks, regulatory developments, audit findings, compliance status and overdue remediation matters in a decision-oriented manner.
- Ensure decisions and action items arising from governance forums are appropriately tracked.
- Provide oversight for cybersecurity and information-security awareness programmes.
- Promote risk ownership and accountability among IT and business stakeholders.
- Support phishing-awareness exercises, employee awareness programmes and relevant ecosystem/DP training.
- Strengthen understanding of regulatory and cybersecurity responsibilities across stakeholders.
- CISA Certified Information Systems Auditor
- CRISC Certified in Risk and Information Systems Control
- CISM Certified Information Security Manager
- CISSP Certified Information Systems Security Professional
- ISO 27001 Lead Auditor / Lead Implementer
- ISO 22301 Lead Auditor / Lead Implementer
- Relevant risk-management/governance certifications
- Significant experience in IT governance, cybersecurity, IT risk, regulatory compliance, audit or technology assurance.
- Experience within financial services, securities markets, banking, market infrastructure or another highly regulated environment would be strongly preferred.
- Demonstrated experience interacting with auditors, senior management and regulatory/compliance stakeholders.
- IT Governance Technology Risk
- Cybersecurity Governance
- Regulatory Compliance Management
- Audit Assurance
- Cyber Resilience / BCP / DR
- Third-Party Risk Management
- ITGC and control frameworks
- Regulatory gap assessment
- Incident governance
- Risk and compliance reporting
- Regulatory interpretation and judgement
- Risk-based decision making
- Executive communication
- Senior stakeholder management
- Team leadership
- Negotiation and influencing
- Analytical thinking
- Structured problem solving
- Ability to challenge constructively
- Strong documentation and presentation capability
Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.