Role Summary

Lead enterprise-wide Governance, Risk & Compliance (GRC) strategy to ensure a robust security posture, regulatory compliance, and risk visibility across global operations. Drive alignment of security, compliance, and business objectives while enabling secure digital transformation.

Key Responsibilities

1. GRC Strategy & Leadership

- Define and execute enterprise GRC strategy aligned with business and regulatory objectives.
- Establish unified governance frameworks across geographies and business units.
- Drive policy standardization, risk governance, and compliance transformation initiatives.

1. Governance & Framework Management

- Develop and maintain governance frameworks for:

- ISO 27001

- SOC 2

- PCI DSS

- GDPR

- ISO 27701

- HIPAA
- Design policy lifecycle management, audit cycles, and compliance workflows.
- Ensure alignment with enterprise architecture, SOC, and IT operations.

1. Risk Management & Compliance

- Lead Enterprise Risk Management (ERM), including:

- Risk identification

- Risk assessment

- Risk mitigation

- Risk reporting
- Conduct and oversee internal and external audits (ISO, SOC 2, regulatory).
- Ensure compliance with global regulatory and privacy requirements.

1. Audit, Assurance & Certifications

- Own audit strategy and execution, including:

- Internal audits

- External audits

- Certification audits
- Drive closure of audit findings (Major/Minor Non-Conformities and OFIs) with business stakeholders.
- Manage certification roadmaps and sustain compliance posture.

1. Third-Party & • Vendor Risk Management

- Establish and manage vendor risk management frameworks.
- Conduct due diligence, risk assessments,



and compliance monitoring of third parties.
- Collaborate with procurement, legal, and IT security teams for vendor governance.

1. Security Governance & • Business Alignment

- Advise business units on secure and compliant practices.
- Embed security and compliance into digital transformation, cloud, and AI initiatives.
- Enable risk-aware decision-making through dashboards and KPIs.

1. Incident Management & • Resilience

- Oversee governance for incident response, forensic investigations, and recovery.
- Ensure business continuity, BCP/DR planning, and cyber resilience.
- Lead executive-level incident communication and escalation.

1. GRC Technology & • Automation

- Drive GRC platform adoption and automation initiatives.
- Define roadmaps for risk visibility, control monitoring, and reporting systems.
- Leverage AI and analytics for predictive risk insights and compliance monitoring.

1. Stakeholder & • Leadership Engagement

- Collaborate with CIO, CISO, Legal, Audit, and Business Leaders.
- Present risk posture, compliance status, and key issues to Board and CXO leadership.
- Drive cross-functional alignment and governance standardization.

1. Team Leadership & • Capability Development

- Build and lead high-performing GRC teams across geographies.
- Develop capabilities in audit, risk, compliance, and governance domains.




- Conduct awareness programs and capability uplift initiatives.

Key Skills & • Competencies

- Robust expertise in:

- ISO 27001

- SOC 2

- GDPR

- PCI DSS

- NIST

- ISO 22301

- Enterprise Risk Management (ERM) and regulatory compliance.
- Audit and certification lifecycle management.
- Third-Party Risk Management (TPRM).
- Cybersecurity governance and data privacy frameworks.

- GRC tools such as Archer, ServiceNow, RSA Archer, OneTrust, and Sprinto.
- Executive communication and Board-level reporting.

Qualifications

- Bachelor's or Master's degree in Engineering, Information Technology, Cybersecurity, or a related field.

- Preferred certifications:

- CISA

- CISM

- CRISC

- CISSP

- ISO 27001 Lead Auditor

- ISO 27001 Lead Implementer

Key Success Metrics (KPIs)

- Risk reduction through improvement in KRIs.
- Audit success rate and timely closure of non-compliance findings.
- Regulatory compliance adherence.
- Reduction in third-party risk exposure.

- GRC maturity and automation improvements.
- Business enablement through secure governance frameworks.

Ideal Profile

- Proven experience in leading large-scale global GRC functions.

- Strong stakeholder management skills with CXO and Board-level leadership.
- Demonstrated success in driving transformation, automation, and standardization.
- Ability to balance compliance requirements with business agility.

Mandatory Skills

- ISO 27001 Lead Auditor / Lead Implementer Certification
- PCI DSS
- Information Security Governance
- Enterprise Risk Management (ERM)

- Regulatory Compliance & Audits
- Third-Party Risk Management (TPRM)

📌 GRC Lead - Risk & Compliance (Greater Noida)
🏢 Coforge
📍 Greater Noida