Role Purpose: Responsible for ensuring appropriate information security governance within the internal and third party-controlled environments. The role is also responsible for supporting the enterprise control environment by ensuring compliance to Policies, procedures and other related documents are defined and updated , assuring Risks are identified and managed, applicable Controls are tested as per defined framework, Exceptions are recorded & remediated on-time, Control Data is analyzed and used for continuous improvement and optimization. InfoSec being a governance function for Risk Management, GRC lead is expected to manage First Party, Second Party and Third Party risk management activities & Internal/external audits per defined framework in accordance to regulatory requirement, under direction of CISO & ERM Role Accountability
• Develop GRC operating model and enterprise-wide security policies and operationalize various GRC capability areas such as enterprise security risk management, compliance management, policy management, security awareness training, third party risk management, and metrics and reporting
• Develop measures and metrics to evaluate the information security programs / Information Security Exception Management/ standards including ISO 27001, PCI-DSS, NIST CSF, COBIT etc. and modifies strategies as appropriate
• Lead the operationalization of security compliance programs to support various compliance regulations
• Perform risk assessments that address security threats, changes to systems and/or applications, process improvement initiatives, supplier assessments (including downstream outsourcers) and other requests from the business




• Maintain accurate reporting of remediation activities to bring appropriate visibility to stakeholders
• Monitor the security risk profiles of suppliers/ third party vendors to objectively determine high risk suppliers that require additional review
• Respond to customer security/compliance questionnaires
• Ensure policies, procedures, standards, and system configurations are documented, formally approved, published (including periodic reviews and updates) and communicated to all SBIC stakeholders
• Monitor the legal and regulatory setting for recent developments
• Provide Information Security Policy awareness training to SBIC employees, contractors and senior management team members, security operations team
• Oversees the planning, execution, and management of programs and projects related to compliance, control assurance, risk management, security, and infrastructure/information asset protection
• Work with third-party auditors to facilitate audits & compliance assessments
• Manage Information Security related risk for all the Vendor and Third Parties as part of the Vendor Risk Management
• Support audits and assessments conducted by both Internal stakeholders (Internal Audit, Compliance, Risk etc.) and external auditors (Regulator)




• Oversee process documentation and compliance adherence Measures of Success
• Timely and accurate Vendor Risk identification, remediation and closure
• Timely updation of infosec/cyber security policies in line with regulatory requirements
• Timely implementation of Agile security compliance programs
• Timely and accurate reporting of security, risk and compliance metrics for operational & executive management
• Increase in maturity of Information Security Matrix
• Timely identification, remediation & closure of gaps to stay compliant with regulatory requirements
• No adverse observations in internal/external audits
• Process Adherence as per MOU Technical Skills / Experience / Certifications
• Functional knowledge of ISMS domains and information security industry standard and best practices
• Sound knowledge of industry best practices and popular frameworks like ISO 27001:2013, COBIT, NIST and standards/regulations like PCI-DSS, RBI
• Extensive knowledge of information security management systems
• Good Documentation. Conducting internal assessments of IT Policies, Standards and Process compliance to IT Audit standards
• Risk-related industry-standard certifications such as CISA, CISM, CISSP would be a strong recommendation Competencies critical to the role
• Stakeholder Management
• Analytical Ability
• Influencing Skills
• Process Orientation
• Teamwork & Collaboration Qualification Graduate in any discipline Preferred Industry BFSI / NBFC /E-commerce/IT & ITES / Telecom

📌 Vice President – Governance Risk (Gurugram)
🏢 Sbi Card
📍 Gurugram