Head of GRC

About Us:

At apexanalytix, we're lifelong innovators. Since our founding nearly four decades ago we've been consistently growing, profitable, and delivering the best procure-to-pay solutions to the world. We're the perfect balance of established company and start-up.

Most of our clients are on The Global 2000. They trust us to give them the latest in controls, audit and analytics software every day. Industry analysts consistently rank us as a top supplier management solution, and you'll be helping build that reputation.

The Role:

apexanalytix is seeking an experienced governance, risk and compliance leader to serve as Head of GRC, based in the United States or in Noida, India. The role reports to the Chief Product & Technology Officer (CPTO) and owns the company's control framework, its ISO 27001, SOC 1 and SOC 2 programs, and its enterprise and third-party risk management. The role gives independent assurance that controls operate as intended across the organization.

The role is deliberately independent of the controls it tests. GRC sets the standards other teams work to, tests whether their controls work, and reports the results directly to the CPTO.

Trusted Advisor:

• Advises the CPTO, the executive team and, as needed, the Board or Audit Committee on risk position, compliance obligations and the state of controls.
• Gives product and engineering leaders an early view of the compliance and risk impact of new products, AI capabilities, architecture changes and acquisitions.
• Acts as the senior voice of security and compliance assurance toward enterprise customers, auditors and regulators.
• Works with Legal, Privacy and Finance to turn regulatory and contractual obligations into practical control requirements.

The Work:

• Defines and runs a multi-year GRC strategy and roadmap, and reports regularly to the CPTO and executive team.
• Owns security policy and standards, including annual review, exceptions and employee attestation.
• Leads the ISO/IEC 27001, SOC 1 Type II and SOC 2 Type II programs and manages external auditors.
• Maintains a single control framework mapped across NIST CSF, ISO 27001, SOC 2 and CIS.
• Tracks regulatory obligations across jurisdictions, including GDPR, CCPA/CPRA, DORA, NIS2, the EU AI Act, India's DPDP Act and CERT-In rules.
• Sets control requirements and tests how well controls work across Security Operations, Technology Operations, corporate IT, Platform and product teams.
• Monitors vulnerability management and patching against agreed SLAs and reports key risk indicators.
• Runs the enterprise and information security risk program, including the risk register, treatment plans and named risk owners.
• Reviews security incidents, sets business continuity and disaster recovery requirements, and confirms plans are tested.
• Owns third-party risk management for subprocessors, cloud providers and critical suppliers.
• Works with the Head of AI & Data to set governance for models and agents.
• Oversees responses to security questionnaires, RFP security sections, due diligence requests and customer audits, and maintains a trust center.
• Advises Sales, Legal and Customer Success on security and compliance commitments in contracts.
• Builds, leads and develops the GRC team across the US and Noida sites.
• Owns GRC tooling, GRC budget planning, vendor management and the security awareness program.

First-Year Priorities:

• Complete the handover of Security Operations to Technology Operations with no disruption to certifications.
• Publish a GRC charter, agreed with the CPTO, that sets out GRC's independence and decision rights.
• Deliver the next ISO 27001, SOC 1 and SOC 2 cycles on time with no significant exceptions.
• Stand up a single control framework and a current risk register with a named owner for every top risk.
• Agree vulnerability SLAs and key risk indicators with Technology Operations and report them to the CPTO monthly.
• Confirm GRC coverage of the Noida site, including India obligations under the DPDP Act and CERT-In rules.
• Cut turnaround time for customer security reviews and launch a trust center.
• Set a baseline for the share of controls monitored automatically, and show measurable improvement.

Required Skills:

• 10+ years of experience in governance, risk and compliance, IT audit or information security, including 5+ years leading a team.
• A proven record of leading ISO 27001 and SOC 2 Type II programs in an enterprise SaaS company. Experience with SOC 1 and SOX IT general controls is a strong plus.
• Deep knowledge of control frameworks (NIST, ISO, SOC, CIS) and of global privacy regulation.
• Enough security operations knowledge to credibly test and challenge detection, response, vulnerability management and access controls.
• Experience building or scaling an enterprise risk program and presenting risk to executives and Boards.
• Experience running GRC across US and India delivery centers, including familiarity with the DPDP Act and CERT-In requirements.
• Strong influencing skills, including holding operational teams to account without direct authority over them.
• Experience with AI governance frameworks such as NIST AI RMF and ISO/IEC 42001 is a plus.
• Experience with B2B enterprise software, ideally in fintech, procure-to-pay, payments or data services, is a strong plus.
• Strong communication skills, including turning technical risk into business terms.

Education Levels/Credentials:

• An undergraduate degree in information systems, computer science, accounting, business or a related field is required; equivalent professional experience will be considered. Certifications such as CISA, CRISC, CISSP, CISM, ISO 27001 Lead Auditor or Implementer, or CIPP/E are strongly preferred.

Physical/Remote/Travel Work Environment:

• An apexanalytix office in the United States or the Global Capability Center in Noida, India, with hybrid working.
• Regular overlap with US Eastern business hours and with India business hours for the Noida teams.
• Travel required: up to 20%, including travel between the US and Noida sites.

Benefits:

apexanalytix offers competitive benefits for the countries it serves, in addition to its BeWell@apex wellness initiative. The company also provides a Mentor Program, Internal Training Portal, and Education, Tuition, and Certification Assistance.