IT Security/GRC Lead

Role :Work to ensure the organisation's overall compliance with global and regional information security and data privacy regulations, including but not limited to - GDPR, NIST Cybersecurity Framework and India's Digital Personal Data Protection (DPDP) Act.Act as the Data Protection Officer (DPO) and Consent Manager, driving the implementation of robust security and privacy practices across global operations to safeguard personal and sensitive data and maintain regulatory adherence.What You'll Do :1. Security framework and policy management :- Develop and manage an Internal Controls framework for IT Governance.- Create operational processes, procedures, standards and guidelines.- Maintain the organisation's ISMS policy/procedure documents.- Ensure an up-to-date repository of documents on SharePoint.2. Audit facilitation and compliance enforcement :- Engage with auditors, compliance teams and regional office representatives.- Coordinate with internal and external stakeholders to close audit findings promptly.- Oversee the organisation's compliance with data protection laws, especially the EU's General Data Protection Regulation (GDPR).- Assist in enforcing security policies and procedures across the organisation.- Work with IT and operational teams to ensure compliance.3. Support and implement IT GRC initiatives :- Support and implement global IT GRC initiatives.- Collaborate with program leadership to align with common objectives.- Develop and enhance the organisation's information security, governance, risk and compliance strategy.- Understand structured and unstructured data types.4. Cloud security and vulnerability assessment :- Assess cloud environment security and conduct vulnerability assessments/penetration testing (VA/PT) to identify and mitigate risks.5. Infosec awareness program :- Develop and drive information security awareness through training, awareness mailers and other channels, and deliver a training program for employees to build privacy awareness.6. Security process automation :- Assist in automating security processes where possible.7. Business impact assessment (BIA) :- Conduct annual BIA exercises to ensure business continuity.- Identify critical SaaS based business applications and their Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO).- Conduct Data Protection Impact Assessments (DPIAs): advising on necessity, scope and mitigation strategies.8. Industry best practices and legal monitoring :- Stay current with industry best practices.- Monitor legal and regulatory developments.9. Stakeholder engagement :- Build and maintain strong relationships with key stakeholders to ensure alignment of risk management objectives and regulatory requirements.- Communicate complex compliance and risk issues in a clear, actionable manner, enabling stakeholders to make informed decisions and support organisational governance goals.What We're Looking For :- A bachelor's degree in IT, cyber security or a related field is required (CISA, CISSP, CISM or other ISMS/information security certifications are preferred).- 4+ years of proven experience in cybersecurity, GRC, information security or ISMS implementation/sustenance roles.- In-depth knowledge of ISO27001 standards, DPDP Act, GDPR and NIST frameworks and control requirements.- Experience in InfoSec compliance reviews and gap assessments.- Prior experience with internal/external audits related to ISMS or IT General Controls (ITGC).- Knowledge of security-related technologies such as IDAM, PAM, Patch Management tools, Encryption, DLP, Antivirus and Firewalls.- Strong understanding of IT infrastructure, including Cloud and M365 environments.- Understanding of Data Privacy/GDPR concepts and controls (preferred).- Strong written and verbal communication skills, including proficiency with PPT.- Ability to explain technical concepts to non-technical individuals at any level. (ref:hirist.tech)