GRC Manager

Position Overview:

Drive LeadSquared's information security, privacy, BFSI regulatory, and AI governance compliance program. This senior, hands-on role leads audits, risk and control governance, customer assurance, policy management, evidence readiness, and cross-functional coordination across ISO 27001:2022, SOC 2 Type 2, HIPAA, GDPR, CCPA, DPDP Act, RBI, SEBI, IRDAI, and ISO/IEC 42001.

Key Responsibilities:

• Compliance & audits: Own end-to-end ISO 27001:2022, SOC 2 Type 2, HIPAA, privacy, BFSI, and ISO/IEC 42001 programs, including readiness, internal audits, management reviews, external assessments, evidence, dashboards, and remediation.
• Privacy & regulatory: Operationalize GDPR, CCPA, DPDP Act, RBI, SEBI, and IRDAI requirements, including data mapping, DPIAs, ROPA, retention, cross-border transfers, localization, outsourcing, and breach notifications.
• Policy & risk governance: Maintain policies, standards, exceptions, risk registers, and assessments covering security, privacy, third parties, AWS/cloud, SDLC, DevOps, applications, and AI; track owners, mitigation, residual risk, approvals, and closure.
• AI governance: Build and improve an ISO/IEC 42001-aligned AI Management System, including use-case inventories, impact and risk assessments, responsible-AI controls, vendor reviews, human oversight, monitoring, and evidence.
• Assurance & stakeholders: Lead customer RFIs/RFPs, security and privacy questionnaires, audits, and customer discussions; coordinate Security, IT, Engineering, Product, Legal, Privacy, HR, Customer Success, auditors, and regulators.
• Operations & improvement: Oversee incident compliance, RCA/CAPA, vendor risk, awareness and phishing programs, GRC automation, regulatory tracking, control monitoring, reporting, and continuous maturity improvements; mentor team members. Perform AI driven compliance automation.

Qualifications:

• 7–10 years in information security GRC, audit, risk, and privacy, with proven ownership of enterprise compliance programs.
• Mandatory: Multiple end-to-end ISO 27001:2022 and SOC 2 Type 2 audit cycles; privacy compliance (GDPR, CCPA, DPDP Act); BFSI regulations (RBI, SEBI, IRDAI); SDLC/DevOps and AWS risk assessments; and customer security/privacy RFI responses.
• Strong knowledge of OWASP Top 10 cloud, application and AI security risks, incident management, third-party risk, and experience in GRC/compliance-automation platforms such as Sprinto, AuditBoard, Drata, etc.
• Mandatory working knowledge of AI governance, including lifecycle risk, data quality, monitoring, fairness, explainability, transparency, accountability, human oversight, and third-party AI risk.
• Bachelor's degree in Information Security, Computer Science, or related field; Master's preferred. Certifications such as ISO 27001 Lead Auditor/Implementer, CISA, CISM, or CISSP preferred; ISO/IEC 42001 and privacy certifications are advantageous.
• Strong analytical, communication, stakeholder-management, leadership, and mentoring skills.