Assistant. Vice President – IT Governance, Risk & Compliance (IT GRC)

Designation Location Function Role Level Role Type Experience Level

• *Assistant Vice President – IT GRC** Mumbai Information Security / Technology Risk \& Governance Senior Management Governance, Risk, Compliance, Regulatory Assurance \& Cyber Resilience Minimum 10 yrs relevant experience

• *1\. Role Purpose**

The AVP – IT GRC is responsible for providing leadership and oversight for the organization's **IT governance, technology and cyber risk management, regulatory compliance, assurance, cyber resilience and management reporting framework.**

• *2\. Key Responsibilities**

• *A. IT Governance \& Policy Oversight**

• Lead the IT/Information Security GRC governance framework and ensure alignment with organizational objectives, regulatory expectations and risk appetite.
• Oversee periodic review and lifecycle management of IT, Information Security, Cybersecurity and related policies, standards, procedures and SOPs.
• Ensure regulatory requirements are appropriately translated into policies, control requirements and accountable implementation actions.
• Establish appropriate governance mechanisms for tracking policy deviations, exceptions and remediation actions.
• Drive consistency between policies, operating procedures, actual controls and audit/regulatory evidence.

• *B. Regulatory Compliance \& SEBI Governance**

• Lead assessment of regulatory circulars, advisories and directions affecting IT, cybersecurity, operational resilience and technology risk.
• Perform/oversee regulatory applicability and gap assessments and establish accountable action plans for identified gaps.
• Coordinate major regulatory submissions relating to areas such as:

+ Cybersecurity

+ System and Network Audit

+ VAPT

+ Red Team assessments

+ IT \& Cyber Risk Assessments

+ Cloud

+ AI/ML

+ CCI/SOC efficacy

+ Technical glitches and cyber incidents

• Coordinate regulatory inspections, including PIQ responses, evidence collation, stakeholder reviews and closure tracking.
• Coordinate communications with applicable authorities and ecosystem stakeholders.

• *C. Enterprise IT \& Cyber Risk Management**

• Provide oversight of enterprise IT and cybersecurity risk assessment programmes.
• Ensure technology risks are identified based not only on regulatory compliance but also on actual threat, business and technology context.
• Maintain management visibility over material risks, control gaps, accepted risks and remediation plans.
• Challenge risk assessments and ensure mitigation plans are proportionate to business and technology exposure.
• Integrate emerging technology risks, including cloud and AI\-related risks, into the technology risk\-management framework.

• *D. Audit, Assurance \& Certification Management**

Provide senior\-level governance and coordination for

• Cybersecurity audits
• System and Network audits
• ITGC audits
• IT \& Cyber Risk assessments
• ISO 27001
• ISO 22301
• ISO 9001, where applicable
• CCI/SOC efficacy assessments
• Internal and external assurance exercises
• Regulatory inspection requirements

• *E. Cyber Resilience, BCP \& DR Governance**

• Provide governance oversight for cyber resilience, business continuity and disaster recovery requirements.
• Review resilience risks, BCP/DR controls, risk assessments and supporting evidence.
• Ensure identified resilience gaps are appropriately escalated and tracked.
• Support alignment of resilience practices with applicable regulatory requirements.
• Oversee governance of resilience testing and management reporting.

• *F. Cybersecurity Regulatory Framework**

• Provide governance oversight over compliance with the applicable Cyber Security and Cyber Resilience Framework and related requirements.
• Monitor major compliance gaps and implementation programmes.
• Ensure critical cybersecurity risks, control weaknesses and recurring observations receive appropriate management attention.
• Coordinate assurance and reporting requirements supporting cybersecurity maturity and resilience.

• *G. Third\-Party / Vendor Risk Management**

• Provide governance oversight over technology and cybersecurity risks associated with third parties and service providers.
• Ensure risk\-based due diligence is undertaken for relevant vendors.
• Monitor significant third\-party control gaps and remediation actions.
• Coordinate with IT, procurement, business, legal and Information Security stakeholders on vendor\-risk requirements.
• Ensure third\-party cybersecurity and resilience risks are incorporated into the overall GRC framework.

• *H. Management \& Governance Committee Reporting**

• Provide senior management with a consolidated view of technology, cybersecurity, compliance and operational\-resilience risks.
• Prepare and review management and governance committee papers.
• Present material risks, regulatory developments, audit findings, compliance status and overdue remediation matters in a decision\-oriented manner.
• Ensure decisions and action items arising from governance forums are appropriately tracked.

• *I. Security Awareness \& GRC Culture**

• Provide oversight for cybersecurity and information\-security awareness programmes.
• Promote risk ownership and accountability among IT and business stakeholders.
• Support phishing\-awareness exercises, employee awareness programmes and relevant ecosystem/DP training.
• Strengthen understanding of regulatory and cybersecurity responsibilities across stakeholders.

• *3\. Qualifications \& Experience**

• *Professional Certifications**

One or more relevant certifications would be desirable, for example

• **CISA –** Certified Information Systems Auditor
• **CRISC –** Certified in Risk and Information Systems Control
• **CISM** Certified Information Security Manager
• **CISSP –** Certified Information Systems Security Professional
• **ISO 27001 Lead Auditor / Lead Implementer**
• **ISO 22301 Lead Auditor / Lead Implementer**
• Relevant risk\-management/governance certifications

• *Experience**

• Significant experience in IT governance, cybersecurity, IT risk, regulatory compliance, audit or technology assurance.
• Experience within **financial services, securities markets, banking, market infrastructure or another highly regulated environment** would be strongly preferred.
• Demonstrated experience interacting with auditors, senior management and regulatory/compliance stakeholders.

• *4\. Critical Competencies**

• *Domain Competencies**

• IT Governance \& Technology Risk
• Cybersecurity Governance
• Regulatory Compliance Management
• Audit \& Assurance
• Cyber Resilience / BCP / DR
• Third\-Party Risk Management
• ITGC and control frameworks
• Regulatory gap assessment
• Incident governance
• Risk and compliance reporting

• *Leadership Competencies**

• Regulatory interpretation and judgement
• Risk\-based decision making
• Executive communication
• Senior stakeholder management
• Team leadership
• Negotiation and influencing
• Analytical thinking
• Structured problem solving
• Ability to challenge constructively
• Strong documentation and presentation capability