- Develop, review, and maintain information security policies, standards, procedures, and guidelines.
- Ensure alignment with business objectives, regulatory requirements, and industry best practices.
- Drive security governance committees and provide regular updates to leadership.
1. Risk Management
- Lead enterprise-wide cybersecurity risk assessments.
- Identify, analyze, and prioritize information security risks.
- Develop risk treatment plans and track remediation activities.
- Maintain the organization's risk register and risk reporting dashboards.
1. Compliance Management
- Manage compliance against standards and regulations such as:
- ISO 27001
- NIST CSF
- SOC 2
- GDPR
- PCI-DSS
- HIPAA (where applicable)
- DPDP Act and other local regulations
- Coordinate internal and external audits.
- Address audit findings and ensure timely closure.
1. Third-Party & • Vendor Risk Management
- Conduct security assessments of vendors and third parties.
- Review contracts, security questionnaires, and compliance evidence.
- Monitor vendor risks and remediation activities.
1. Security Awareness & • Training
- Develop and manage security awareness programs.
- Conduct phishing simulations and awareness campaigns.
- Promote a security-first culture across the organization.
1. Regulatory & • Customer Assurance
- Support customer security assessments and due diligence requests.
- Respond to RFP/RFI security questionnaires.
- Act as a liaison between security teams, auditors, regulators, and business stakeholders.
1. Team Leadership & • Stakeholder Management
- Lead and mentor GRC analysts and consultants.
- Collaborate with SOC, IAM, Vulnerability Management, Infrastructure, Legal, HR, and Compliance teams.
- Drive cross-functional security initiatives.