` Annexure I: ABG Template `

HayGroup

Template 2024

Ver. 1.1

Basic Details: Fill the required information about Job

Poornata Position

Number of the job

9

Poornata Position

Title of the job

(30 characters max)

Chief Manager

Business Aditya Birla Capital Business Unit Aditya Birla Health Insurance

Effective Date

(DD/MM/YYYY) 29-10-2025

- Job Purpose: Write the purpose for which the job exists (in 2-3 lines) (Max 1325 Characters)
- Governance, Risk and Compliance Audit (GRCA): Ensures audits cover governance structures,

regulatory compliance, security frameworks, business continuity, and incident response with regular documentation and remedial actions.
- Third-Party Risk Management (TPRM): Evaluates vendor security posture using questionnaires, AIdriven assessments, audits, and contract reviews, ensuring compliance with privacy laws and effective incident response.

3.

Intermediaries Audit: Reviews intermediaries’ cyber policies, board-approved controls, and oversight mechanisms to ensure safe data handling and regulatory compliance.

4.

Legal Document Review: Ensures contracts include clear clauses for information security, data privacy,

AI governance, breach notification, and regulatory adherence aligned with organizational policies.

- AI Security for Third-Party Vendors: Requires transparency about AI use, robust security controls, bias mitigation, continuous monitoring, incident response, and regulatory compliance prior to onboarding AI vendors.
- Job Context &
- Major Challenges: Write the specific aspects of the job that provide a challenge internal and external) to the jobholder in the context of the Business/Unit/Function/Department/Section

(Max 3975 Characters)

The role operates within a complex and dynamic environment where ensuring robust information security governance, risk management, and compliance (GRCA) is critical. Internally, the job holder faces the challenge of integrating evolving regulatory requirements, organizational policies, and technological advancements into practical and enforceable security frameworks, while aligning with business objectives across multiple departments.

Major internal challenges include

` Annexure I: ABG Template `

HayGroup

Template 2024

- Job Context &
- Major Challenges: Write the specific aspects of the job that provide a challenge internal and external) to the jobholder in the context of the Business/Unit/Function/Department/Section

(Max 3975 Characters)
- Managing coordination and communication between diverse stakeholders such as IT, legal, HR,

compliance and business units to ensure unified risk mitigation strategies.
- Keeping pace with rapidly changing cyber threat landscapes and ensuring that control measures—

including AI security protocols—remain effective and relevant.
- Balancing stringent security requirements with operational efficiency and business needs, especially when dealing with third-party risk management (TPRM) and onboarding AI vendors.
- Maintaining thorough documentation, audit readiness,



and remediation tracking amid frequent changes and updates.
- Ensuring staff training and awareness programs effectively address evolving threats and compliance mandates.

Externally, the sfbhjazjob holder contends with challenges related to vendor and third-party management,

including:

- Conducting rigorous assessments of vendors' security postures, AI governance, and data privacy practices amidst diverse technological capabilities and regulatory environments.
- Navigating contractual negotiations to embed adequate security and compliance clauses, including those for AI-related risks.
- Addressing complexities of auditing intermediaries and ensuring they meet the organization’s security and regulatory expectations.
- Managing incident response and liability concerns that arise from third-party breaches or AI system failures.
- Staying abreast of emerging regulations globally that impact vendor management and AI security,

ensuring continuous compliance.

Overall, the role demands a proactive, multidisciplinary approach to information security that anticipates risks, drives compliance, nurtures vendor relationships, and fosters a security-conscious culture within the organization and its extended ecosystem.

- Dimensions: Mention quantitative or qualitative parameters that are relevant for the job and provide a better understanding of the scope and scale of the job.

Business Workforce Number

(Max 254 Characters) 8500 (All ABHICL Employees)

Unit Workforce Number

(Max 254 Characters) 8500 (All ABHICL Employees)

` Annexure I: ABG Template `

HayGroup

Template 2024

Function Workforce Number

(Max 254 Characters) 8500 (All ABHICL Employees)

Department Workforce Number

(Max 254 Characters) 8500 (All ABHICL Employees)

Other Quantitative and Important

Parameters for the job: Budgets/

Volumes/No. of Products/Geography/

Markets/ Customers or any other parameter

- Overseeing security and compliance for "N" number of third-party vendors, including AI service providers,

intermediaries, and contractors across diverse service lines.
- Reviewing and managing compliance for a large volume of legal agreements annually—commonly hundreds—that involve data privacy, security clauses,

and AI governance provisions.
- Supporting operations across ABHICL, ensuring adherence to regional cybersecurity regulations (e.g.

IRDAI &
- DPDPA in India).
- Coordinating multiple internal and external audits yearly, including GRCA, TPRM, intermediaries, and AI compliance assessments.
- Key Result Areas:



Write the key results expected from the job and the supporting actions for each of these key result areas (For majority of jobs typically there could be 4- 7 key result areas)- Maximum 10

KRAs can be updated

Key Result Areas (Max 1325 Characters) Supporting Actions (Max 1325 Characters)

Information Security Governance

Develop and enforce security policies; ensure compliance through audits and continuous monitoring

Risk Management &

- Compliance Conduct GRCA &
- TPRM audits; manage risk remediation & track clousre of findings

Vendor &
- Third-Party Security

Assess and onboard vendors including AI vendors,

maintain ongoing security and compliance monitoring

Legal and Contractual Complaince

Review and validate contracts for security, privacy and AI governance clauses; coordinate with legal teams

Reporting & communication Provide regular reports on security posture, risks and audits status to stakeholders

Continuous Improvement

Monitor emerging threats and regulatory changes;

drive initiatives to enhance security posture.

` Annexure I: ABG Template `

HayGroup

Template 2024

Ethical &

- AI Governance

Ensure AI and automation systems operate transparently, ethically, and without bias; establish accountability mechanisms.

Audit &

- Inspection Management

Plan, coordinate, and oversee internal and external audits; remediate any non-compliance findings effectively.

Regulatory &

- Standards Compliance

Keep abreast of evolving regulations like IRDAI,

DPDPA; ensure organizational policies align and are enforced.

` Annexure I: ABG Template `

HayGroup

Template 2024

- Relationships: Describe the nature and purpose of most key contacts or relationship (except superior/team members) with individuals, departments, organizations inside and outside of the organization, that job is required to interact with in order to deliver the job objectives

Relationship Type

(Max 80 Characters) Frequency Nature

(Max 1325 Characters)

Internal

Legal team Regular Contract review and legal compliance

IT Department Frequent

(Daily/Weekly)

Security technology deployment, incident response

Compliance &

- All Business As required Regulator adherence and audit coordination

Auditors (Internal/External) Periodic (Quaterly) Security and Compliance audits

Customers / Business Units Frequent Security requirements gathering, risk impact review

Incident Response Teams As needed Security incident coordination and resolution

External

Vendors/ Third Party providers

Ongoing Security Assessment, Compliance Monitoring

AI Vendors Ongoing

AI security evaluation, risk mitigation,

governance

Regulatory Authorities As required (Audit

Cycles)

Compliance audits and reporting

Auditors (Internal/External) Periodic (Annual) Security and Compliance audits

` Annexure I: ABG Template `

HayGroup

Template 2024

` Annexure I: ABG Template `

HayGroup

Template 2024

SIGN-OFF: Provide the name of the Manager and the jobholder. Signature needed for the hard copy of the

JD. Hard copy to be maintained in the organizational record.

Job Holder Reports to – Manager

Name Jaya Pathak Shrikant Iyer

Signature (needed for the hard copy)

📌 Team Member - Infosec (Maharashtra)
🏢 Aditya Birla Capital
📍 Maharashtra