Key responsibilities

1. Business-to-control translation

- Work with process owners (Finance, Retail Ops, Supply Chain, HR, E-commerce, Customer) to identify where cyber risk can cause financial loss, misstatement, fraud, data leakage or disruption.

- Turn each business risk and policy commitment into a documented control: objective, owner, frequency, type (preventive/detective, manual/automated) and evidence required.

- Maintain the Cybersecurity Risk & Control Matrix (RCM) as part of the overall IFC framework, mapped to business processes and key systems.

- Ensure recent business initiatives, system changes and vendor onboarding carry the right controls from day one, by reviewing them at design stage.

1. Control validation and testing

- Define test procedures for each control: what to sample, what evidence proves it works, and what counts as a failure.

- Perform test of design (TOD) and test of operating effectiveness (TOE) on a risk-based annual calendar.

- Cover core control areas: user access and segregation of duties, privileged access, change management, backup and recovery, logging and monitoring, vulnerability and patch management, endpoint and device controls, third-party/vendor access, and data protection.

- Validate controls across the key estate SAP, ETP, e-commerce, warehouse, cloud and data platforms – by reviewing evidence and outcomes, not by configuring systems.

- Verify that automated controls and system-generated reports used in financial controls are complete and accurate.

1. Effectiveness and efficiency review





- Assess whether each control actually reduces the risk it targets, and flag controls that are redundant, overlapping or too costly for the risk covered.

- Recommend rationalisation, automation or continuous monitoring where it lowers effort and improves reliability.

- Track control health indicators (failures, exceptions, overdue reviews) and report trends, not just point-in-time results.

1. Deficiency management and remediation

- Classify findings by severity (deficiency, significant deficiency, material weakness) using the IFC methodology.

- Agree remediation actions, owners and dates with business and Technology, and re-test closure.

- Escalate overdue or repeat issues through the IFC governance route.

1. Governance, reporting and audit support

- Prepare periodic cyber-control dashboards and notes for the Head of IFC, CFO, CTO and Audit Committee.

- Act as the single point of contact for statutory auditors, internal auditors and Tata Group reviews on cyber-related IFC controls; coordinate evidence and walkthroughs.

- Support management's IFC sign-off and MD/CFO certification with evidence on cyber controls.

- Track regulatory and contractual obligations that create control requirements – for example the DPDP Act, CERT-In directions and PCI DSS for card payments – and confirm they are reflected in the control set.

1. Awareness and control culture

- Help control owners understand their responsibilities, what evidence to retain, and why the control matters to the business.

- Contribute to control self-assessment (CSA) design and review its quality.

📌 Cybersecurity Controls Assurance (Mumbai)
🏢 Trent
📍 Mumbai