IT GRC - Assistant Manager

Job Summary:

We are looking for a techno-functional professional to join our RegTech & Cyber Risk practice. The role sits at the intersection of technology, regulation, and compliance advisory requiring an individual who is equally at home reviewing IT systems and audit artefacts as they are interpreting RBI Master Directions and advising clients on compliance posture.

The successful candidate will work across regulatory compliance engagements covering the RBI IT Governance, Risk, Controls and Assurance (ITGRCA) framework, IT Outsourcing and TPRM norms, Digital Lending guidelines, Payment and Settlement Systems regulations, and frameworks governing Payment Aggregators / Payment Gateways (PA/PG) and Prepaid Payment Instruments (PPI). This is a growth-track role with direct client interaction and practice development responsibilities.

Roles & Responsibilities:

• Shall possess hands-on technical experience executing a diverse range of engagements,

including IT General Controls (ITGC) audits, comprehensive Internal Audits of complex IT

environments, and the evaluation/preparation of SOC reports.

• Shall independently drive and execute regulatory compliance audits spanning diverse

financial entities, including Banks, NBFCs, Fintechs, Insurance Brokers, and Stockbrokers

ensuring adherence to applicable RBI, SEBI, and IRDAI norms.

• Ability to critically evaluate technical evidence, identify inconsistencies, and detect control

circumvention risks across applications, databases, and infrastructure.

• Shall independently verify that the organizations IT strategy, policy frameworks, and Board

level oversight (ITSC/ACB) strictly align with regulatory Master Directions and maintain a

clear, independent reporting line for the CISO.

• Shall audit the security posture of the extended ecosystem, including third-party vendors,

outsourced IT services.

• Capability to seamlessly bridge the gap between technical IT controls and broader regulatory

expectations, translating complex cyber risks into clear business impacts.

• Shall validate the operational effectiveness of security monitoring (SOC), VAPT cycles, and

BCP/DR readiness to ensure the institution can detect threats in real-time and recover from

system failures within mandatory RPO/RTO targets.

• Susinftrong understanding of the control environments surrounding complex payment

systems, including Payment Aggregators/Payment Gateways (PA/PG), cross-border data

flows, and third-party payment integrations.

• Supervise and review the fieldwork of senior associates/consultants, ensuring that audit

working papers, test scripts, and documentation meet rigorous qualitative standards.

• Collaborating with IT process owners to design practical, risk-mitigating controls and actively

tracking remediation plans to closure.

• Act as a key liaison during external regulatory inspections and statutory audits, facilitating

clear communication between technical IT teams, external auditors, and senior

management.

Educational Qualifications:

• B.E. / B.Tech / B.Sc. (IT/CS/ECE) or B.Com / BBA with strong technology orientation; MBA /

M.Tech is an advantage.

• Certifications considered - CISA, CISSP, CISM, CompTIA Security+, CRISC, CCSP

Skills & Competencies:

Regulatory Knowledge Essential

• RBI IT Governance, Risk, Controls and Assurance (ITGRCA) Master Direction
• RBI Master Direction on IT Outsourcing / Managing Risks in Outsourcing (NBFC / Banks)
• RBI Digital Lending Guidelines (2022 and subsequent updates)
• Payment and Settlement Systems (PSS) Act, 2007 and RBI DPSS frameworks
• Payment Aggregator / Payment Gateway (PA/PG) guidelines Merchant onboarding, escrow,

baseline security

• Prepaid Payment Instruments (PPI) Master Direction wallet issuance, interoperability, KYC

norms

• UPI ecosystem — NPCI operating guidelines, dispute resolution, fraud risk frameworks

Technology & Control Domains

• IT General Controls (ITGC) assessment — access management, change management,

operations, BCP/DR

• Application controls review — input validation, processing controls, output reconciliation
• Cybersecurity frameworks — familiarity with ISO 27001, NIST CSF, CIS Controls
• Data protection and privacy — DPDP Act 2023 awareness; data classification and handling

controls

• Third-party risk management (TPRM) — vendor assessment, contract review, SLA monitoring
• Cloud risk assessment — awareness of shared responsibility models, cloud-specific regulatory

requirements

Tools & Methodology

• Proficiency in MS Excel (audit/risk workbooks, control matrices, scoring models)
• MS PowerPoint — client-facing deliverable and deck preparation
• Familiarity with GRC tools (e.g., SAP GRC, ServiceNow GRC, or similar) is an advantage
• Comfort with data analysis and log review as part of IT audit fieldwork

Behavioural Attributes:

• High level of confidentiality and discretion.
• Ability to perform under pressure and manage multiple competing priorities.
• Customer-service-oriented with a positive attitude.
• Strong problem-solving skills and ability to work collaboratively in a team.