Job Description – Senior GRC / Compliance Team Lead

Company: Nfynox Solutions Pvt. Ltd.
Client: Dynamed
Position: Senior GRC / Compliance Team Lead
Experience: 12+ Years
Employment Type: Full-time – Dedicated Client Deployment
Work Location: Dynamed – Client Location
Mandatory Certification: CISA or CISSP

1. Role Overview

Nfynox Solutions is seeking an experienced and highly skilled Senior GRC / Compliance Team Lead for a full-time deployment at Dynamed.

The selected candidate will be responsible for leading and managing the organization's Governance, Risk, and Compliance (GRC) functions, ensuring effective implementation of information security governance frameworks, regulatory compliance requirements, enterprise risk management, and internal and external audit processes.

The role requires strong expertise in IT governance, cybersecurity risk management, compliance frameworks, internal audits, and stakeholder management, with the ability to independently manage enterprise-level GRC operations.

2. Key Responsibilities

- Lead and manage overall Governance, Risk, and Compliance (GRC), IT governance, and information security compliance activities.

- Develop, implement, review, and maintain information security policies, standards, procedures, and governance frameworks.

- Conduct enterprise IT and cybersecurity risk assessments, maintain risk registers, and monitor risk mitigation plans.

- Plan, coordinate, and manage internal, external, and regulatory audits, including evidence collection, audit reporting, and closure of findings.

- Ensure compliance with applicable frameworks and standards, including ISO 27001, SOC 1/SOC 2, NIST, CIS Controls, HIPAA, and relevant data privacy regulations.

- Conduct compliance gap assessments, control effectiveness reviews, and periodic security assessments.

- Oversee information security controls related to Identity and Access Management (IAM), Privileged Access Management (PAM), Endpoint Detection and Response (EDR),



Data Loss Prevention (DLP), vulnerability management, network security, backup, and disaster recovery.

- Manage third-party/vendor risk assessments and compliance reviews.

- Drive Enterprise Risk Management (ERM), internal audit activities, and legal and regulatory compliance initiatives.

- Coordinate with IT, cybersecurity, HR, legal, business teams, auditors, and senior management.

- Prepare GRC dashboards, risk reports, audit reports, and periodic compliance status updates for management.

- Lead security awareness programs, compliance training, and continuous improvement initiatives.

- Ensure timely remediation and closure of audit observations, compliance gaps, and identified risks.

3. Mandatory Qualifications

- Bachelor's degree in Information Technology, Computer Science, Cybersecurity, or a related discipline.

- Minimum 12+ years of relevant experience in GRC, IT Governance, Information Security, IT Audit, or Compliance.

- CISA or CISSP certification is mandatory.

- Strong hands-on experience in enterprise risk management, IT audits, compliance assessments, and information security governance.

- Good understanding of regulatory compliance, internal controls, audit methodologies, and risk management practices.

- Excellent documentation, communication, stakeholder management, and leadership skills.

- Ability to independently manage enterprise-level GRC and compliance functions.

4. Preferred Skills and Industry Experience

- Experience in healthcare, medical technology, pharmaceutical, or other highly regulated industries.





- Solid knowledge of ISO 27001, SOC 2, NIST, CIS Controls, HIPAA, and GDPR.

- Experience in Enterprise Risk Management (ERM), internal audits, and legal compliance.

- Familiarity with GRC platforms, audit management tools, and risk management solutions.

- Knowledge of business continuity management (BCM), disaster recovery (DR), and third-party risk management.

- Additional certifications such as CISM, in addition to the mandatory CISA or CISSP, will be an advantage.

5. Key Competencies

- Governance, Risk Management, and Compliance (GRC)

- Enterprise Risk Management (ERM)

- Information Security Governance

- Internal and External Audits

- IT Risk Assessment and Mitigation

- ISO 27001 and SOC 2 Compliance

- Regulatory and Legal Compliance

- GDPR and HIPAA

- Security Controls and Audit Management

- Stakeholder and Team Management

- Compliance Reporting and Documentation

6. Expected Outcomes

- Effective management and continuous improvement of GRC and compliance programs.

- Maintaining organizational audit readiness and ensuring timely closure of audit findings.

- Continuous monitoring and reporting of enterprise risks and information security controls.

- Development and maintenance of updated policies, procedures, and compliance documentation.

- Strengthened information security governance and regulatory compliance posture.

- Periodic management reporting on risks, audits, and compliance status.

Requirements

Certification Requirements

Mandatory:

- CISA (Certified Information Systems Auditor) or

- CISSP (Certified Information Systems Security Professional)

Preferred:

- CISM (Certified Information Security Manager)

- Other relevant GRC, risk management, and information security certifications.

Note: Candidates must hold at least one of the mandatory certifications (CISA or CISSP) to be considered for this position.

📌 Senior GRC / Compliance Team Lead (Kochi)
🏢 Nfynox Solutions
📍 Kochi