Manager - GRC

<h1>Job Description</h1> <p>Manager / Senior Manager – Governance, Risk &amp; Compliance (GRC)</p> <h2>Location</h2> <p>Bangalore</p> <h2>Experience</h2> <p>8–10 years of experience in Governance, Risk, Compliance, and Information Security.</p> <h2>Role Overview</h2> <p>The GRC Manager / Senior Manager is responsible for leading cybersecurity governance, risk management, compliance, and awareness programs in ZEE. This role ensures enterprise-wide risk visibility, audit readiness, regulatory compliance, and continuous improvement of the cybersecurity maturity posture.</p> <h2>Key Responsibilities</h2> <h3>Risk Management &amp; Governance</h3> <p>· Maintain an up-to-date enterprise risk register including risk assessment, mitigation, and acceptance inputs with status.</p> <p>· Conduct weekly reviews of enterprise and engineering risks and policy exceptions and track closure.</p> <p>· Perform proactive risk identification through process reviews, audits and control testing.</p> <p>· Publish fortnightly cybersecurity and privacy risk summary reports to leadership.</p> <p>· Track KPIs and publish dashboards indicating control maturity.</p> <h3>Security Awareness &amp; Training</h3> <p>· Plan and execute weekly cybersecurity awareness campaigns via email.</p> <p>· Conduct monthly cybersecurity and privacy training for contractors.</p> <p>· Lead quarterly ethical phishing simulations, reduce phishing failure rates and improve reporting rate.</p> <p>· Execute industry-event-based awareness programs and annual gamified security carnival.</p> <h3>Policies, ISMS &amp; Process Reviews</h3> <p>· Lead annual Information Security Policy and Procedure reviews with cross-functional stakeholders.</p> <p>· Plan and execute ISMS risk assessments, internal and external ISO 27001 audits.</p> <p>· Review cybersecurity processes and recommend enhancement to process and control measures for improvement.</p> <h3>Leadership Reporting &amp; Governance Committees</h3> <p>· Prepare quarterly cybersecurity and monthly business review reports for CIO and leadership.</p> <p>· Convene and manage Information Security &amp; Privacy Steering Committee (ISPSC) meetings and track actions/decision out of the meetings for closure.</p> <h3>Audit, Compliance &amp; Contracts</h3> <p>· Assist the team during internal, corporate, and statutory audits.</p> <p>· Review MSAs, NDAs, and project engagements for security obligations.</p> <p>· Support in security and privacy compliance portal submissions.</p> <h3>Financial &amp; Corporate Governance</h3> <p>· Track cybersecurity budget consumption and renewals.</p> <p>· Provide cybersecurity inputs for ESG, BRSR and Annual reporting.</p> <h2>Qualifications &amp; Certifications</h2> <p>

• Bachelor’s degree in Engineering, Computer Science, or related field.</p>

<p>

• Preferred certifications: CISM, CISSP, CRISC, ISO 27001 Lead Auditor/Implementer.</p>

<h2>Skills and expertise</h2> <ul> <li>GRC &amp; Risk Management</li> <li>ISO 27001 / ISMS</li> <li>Audit &amp; Compliance</li> <li>Security Governance</li> <li>Risk Reporting &amp; Dashboards</li> </ul>