Key Responsibilities
Governance & Policy Management
Develop, review, and maintain information security policies, standards, procedures, and guidelines.
Ensure alignment with business objectives, regulatory requirements, and industry best practices.
Drive security governance committees and provide regular updates to leadership.
Risk Management
Lead enterprise-wide cybersecurity risk assessments.
Identify, analyze, and prioritize information security risks.
Develop risk treatment plans and track remediation activities.
Maintain the organization's risk register and risk reporting dashboards.
Compliance Management
Manage compliance against standards and regulations such as:
ISO 27001
NIST CSF
SOC 2
GDPR
PCI-DSS
HIPAA (where applicable)
DPDP Act and other local regulations
Coordinate internal and external audits.
Address audit findings and ensure timely closure.
Third-Party & • Vendor Risk Management
Conduct security assessments of vendors and third parties.
Review contracts, security questionnaires, and compliance evidence.
Monitor vendor risks and remediation activities.
Security Awareness & • Training
Develop and manage security awareness programs.
Conduct phishing simulations and awareness campaigns.
Promote a security-first culture across the organization.
Regulatory & • Customer Assurance
Support customer security assessments and due diligence requests.
Respond to RFP/RFI security questionnaires.
Act as a liaison between security teams, auditors, regulators, and business stakeholders.
Team Leadership & • Stakeholder Management
Lead and mentor GRC analysts and consultants.
Collaborate with SOC, IAM, Vulnerability Management, Infrastructure, Legal, HR, and Compliance teams.
Drive cross-functional security initiatives.