GRC Manager

Key Responsibilities

1. Governance & Policy Management

• Develop, review, and maintain information security policies, standards, procedures, and guidelines.
• Ensure alignment with business objectives, regulatory requirements, and industry best practices.
• Drive security governance committees and provide regular updates to leadership.

2. Risk Management

• Lead enterprise-wide cybersecurity risk assessments.
• Identify, analyze, and prioritize information security risks.
• Develop risk treatment plans and track remediation activities.
• Maintain the organization's risk register and risk reporting dashboards.

3. Compliance Management

• Manage compliance against standards and regulations such as:

• ISO 27001

• NIST CSF

• SOC 2

• GDPR

• PCI-DSS

• HIPAA (where applicable)

• DPDP Act and other local regulations

• Coordinate internal and external audits.

• Address audit findings and ensure timely closure.

4. Third-Party & Vendor Risk Management

• Conduct security assessments of vendors and third parties.
• Review contracts, security questionnaires, and compliance evidence.
• Monitor vendor risks and remediation activities.

5. Security Awareness & Training

• Develop and manage security awareness programs.
• Conduct phishing simulations and awareness campaigns.
• Promote a security-first culture across the organization.

6. Regulatory & Customer Assurance

• Support customer security assessments and due diligence requests.
• Respond to RFP/RFI security questionnaires.
• Act as a liaison between security teams, auditors, regulators, and business stakeholders.

7. Team Leadership & Stakeholder Management

• Lead and mentor GRC analysts and consultants.
• Collaborate with SOC, IAM, Vulnerability Management, Infrastructure, Legal, HR, and Compliance teams.
• Drive cross-functional security initiatives.

Required Skills

Technical Skills

• ISO 27001 Implementation & Audits
• Risk Assessment Methodologies
• NIST Cybersecurity Framework
• SOC 2 Compliance
• Third-Party Risk Management
• Business Continuity & Disaster Recovery
• Security Controls Assessment
• Regulatory Compliance Management

Managerial Skills

• Team Leadership
• Project Management
• Executive Reporting
• Client Management
• Audit & Stakeholder Handling
• Cross-functional Collaboration