Senior Lead

Role Summary:
The Senior Lead – IS GRC will be responsible for strengthening Crisil's Information Security Governance, Risk, and Compliance (GRC) function through execution of internal audits, risk assessments, compliance reviews, and control effectiveness testing. The role includes managing ISO 27001 certification activities, SOC 2 readiness, NIST CSF implementation, incident response support, employee awareness programs, and automation of IS GRC processes. The candidate will also support risk consulting activities by reviewing business requests for new initiatives or changes and providing risk-based approvals and recommendations.

Key Responsibilities:

• Internal Audit & Control Testing
• Conduct internal audits aligned with ISO 27001:2022 and organizational policies.
• Perform design and operating effectiveness testing of information security and IT controls.
• Maintain audit workpapers, reports, and action trackers in alignment with defined processes.
• SOC 2 Readiness & Audit Management
• Manage SOC 2 readiness activities in line with Trust Services Criteria.
• Coordinate with external auditors and internal stakeholders for successful audit execution.
• Track compliance and control effectiveness related to SOC 2 requirements.
• NIST Cybersecurity Framework (NIST CSF)
• Support implementation and monitoring of NIST CSF controls across relevant domains.
• Conduct gap assessments, document control maturity, and recommend improvements.
• ISO 27001 Implementation & Maintenance
• Lead efforts to sustain ISO 27001 certification, including SOA and Risk Treatment Plan updates.
• Prepare for and manage certification and surveillance audits.
• Support closure of audit findings and continuous improvement activities.
• Risk Management & Consulting
• Perform risk assessments for IT and cybersecurity initiatives and maintain risk registers.
• Evaluate risk impact of business or IT consulting requests and provide formal recommendations or approvals.
• Monitor risk mitigation activities and report risk posture to relevant stakeholders.
• GRC Process Management & Automation
• Drive automation initiatives for control testing, evidence collection, audit tracking, and compliance dashboards.
• Support maintenance and operation of GRC tools and platforms, ensuring data accuracy and completeness.
• Incident Response & Reporting
• Assist in the development and maintenance of the organization's incident response plan.
• Support investigations of security incidents and ensure timely escalation and resolution.
• Training & Awareness
• Conduct periodic cybersecurity awareness training for employees and contractors.
• Reinforce understanding of security policies, roles, and regulatory responsibilities across the organization.

Required Qualifications & Experience:

• Bachelor's degree in Information Technology, Computer Science, or related field.
• Minimum 6 years of experience in information security audits, risk assessments, and compliance.
• Strong understanding of ISO 27001, SOC 2, NIST CSF, ITGC, and risk-based consulting.
• Familiarity with regulatory requirements such as SEBI CSCRF.
• Experience in conducting internal audits, risk reviews, and process automation.
• Preferred certifications: ISO 27001 Lead Auditor, CISA, CRISC, or equivalent.

Key Competencies:

• Strong analytical and documentation skills
• Clear and effective communication with technical and non-technical stakeholders
• Ability to independently manage audits, assessments, and compliance initiatives
• Proactive and structured approach to risk evaluation and issue resolution
• Exposure to GRC platforms and automation tools is preferred