This position is critical to centralizing ownership for driving enterprise\-wide governance and compliance programs, ensuring proactive risk management, audit readiness, and alignment with international standards and local data protection laws. The GRC Lead will work directly with the HOD on multiple GRC initiatives including ISO 27001 certification for Awfis, alignment with the Digital Personal Data Protection (DPDP) Act, Captive Risk Profiling, Third\-Party Risk Management (TPRM), and related programs.**Key Responsibilities****Governance \& Compliance Program Ownership*** + Establish, lead, and continuously mature the enterprise GRC framework across Awfis and Awliv business units.
+ Drive end\-to\-end ownership of ISO 27001 certification for Awfis, including gap assessment, control implementation, internal audits, and external certification readiness.
+ Develop, publish, and maintain information security policies, standards, procedures, and guidelines aligned with industry best practices.
+ Ensure organizational alignment with the DPDP Act and other applicable data protection and privacy regulations.
+ Maintain the enterprise risk register and drive periodic risk review cadence with business and IT stakeholders.
+ Define and track key risk indicators (KRIs) and key control indicators (KCIs); report risk posture to leadership.
+ Recommend and oversee implementation of risk mitigation strategies across functions.
+ Evaluate third\-party security, privacy, and contractual compliance posture; track remediation of identified gaps.
+ Collaborate with Procurement, Legal, and business owners to embed security and privacy clauses into contracts.
+ Track audit findings to closure, drive root cause analysis, and reduce repeat non\-conformities.
+ Improve audit closure timelines through structured tracking, accountability, and reporting mechanisms.
+ Serve as the single point of contact for client security and compliance assessments.
+ Coordinate with Legal and business teams on data processing agreements, privacy notices, and cross\-border data transfer requirements.
+ Support the Data Protection Officer (DPO) function as required.
+ Prepare and present GRC dashboards, metrics, and reports to senior leadership, the HOD, and relevant committees.
+ Conduct awareness and training programs to build a culture of compliance and security accountability.
+ Demonstrated experience driving ISO 27001 certification end\-to\-end (preparation through certification and surveillance audits).
+ Hands\-on experience with DPDP, GDPR, or comparable data protection regimes.
+ Proven track record running TPRM, internal audit, and enterprise risk programs.
+ CISA, CISM, CRISC, or CISSP
+ DCPP, DCPLA, CIPP/E, or CIPM (for privacy)
+ Deep understanding of Indian data protection law (DPDP Act) and global privacy regulations.
+ Familiarity with GRC tools, risk assessment methodologies, and control testing approaches.
+ Sound understanding of IT and cloud infrastructure, application security concepts, and common threat landscapes.
+ Excellent stakeholder management and influencing skills across technical and non\-technical audiences.
+ Strong analytical, problem\-solving, and decision\-making abilities.
+ Clear written and verbal communication, including the ability to present to executive leadership.
+ High integrity, attention to detail, and a structured approach to complex problems.
+ Achieve ISO 27001 certification for Awfis.
+ Deliver DPDP readiness and operationalize ongoing compliance.
+ Stand up a functional TPRM program with defined SLAs and a vendor risk register.
+ Reduce open audit findings and repeat non\-conformities through structured remediation tracking.
+ Publish a quarterly enterprise risk and compliance dashboard for leadership.
Customer Support Specialist - Flex
Rippling · Bengaluru
Full Stack Developer
CodePixel Works · Remote
Centre Manager — Dialysis Centres
Actio · Bengaluru