Manager - GRC & AI Governance

Drive LeadSquared's information security, privacy, BFSI regulatory, and AI governance compliance program. This senior, hands-on role leads audits, risk and control governance, customer assurance, policy management, evidence readiness, and cross-functional coordination across ISO 27001:2022, SOC 2 Type 2, HIPAA, GDPR, CCPA, DPDP Act, RBI, SEBI, IRDAI, and ISO/IEC 42001.

Responsibilities:

• Compliance and audits: Own end-to-end ISO 27001:2022, SOC 2 Type 2, HIPAA, privacy, BFSI, and ISO/IEC 42001 programs, including readiness, internal audits, management reviews, external assessments, evidence, dashboards, and remediation.
• Privacy and regulatory: Operationalise GDPR, CCPA, DPDP Act, RBI, SEBI, and IRDAI requirements, including data mapping, DPIAs, ROPA, retention, cross-border transfers, localisation, outsourcing, and breach notifications.
• Policy risk governance: Maintain policies, standards, exceptions, risk registers, and assessments covering security, privacy, third parties, AWS/cloud, SDLC, DevOps, applications, and AI; track owners, mitigation, residual risk, approvals, and closure.
• AI governance: Build and improve an ISO/IEC 42001-aligned AI Management System, including use case inventories, impact and risk assessments, responsible-AI controls, vendor reviews, human oversight, monitoring, and evidence.
• Assurance and stakeholders: Lead customer RFIs/RFPs, security and privacy questionnaires, audits, and customer discussions; coordinate Security, IT, Engineering, Product, Legal, Privacy, HR, Customer Success, auditors, and regulators.
• Operations and improvement: Oversee incident compliance, RCA/CAPA, vendor risk, awareness and phishing programs, GRC automation, regulatory tracking, control monitoring, reporting, and continuous maturity improvements; mentor team members. Perform AI-driven compliance automation.

Requirements:

• 7-10 years in information security GRC, audit, risk, and privacy, with proven ownership of enterprise compliance programs.
• Mandatory: Multiple end-to-end ISO 27001:2022 and SOC 2 Type 2 audit cycles; privacy compliance (GDPR, CCPA, DPDP Act); BFSI regulations (RBI, SEBI, IRDAI); SDLC/DevOps and AWS risk assessments; and customer security/privacy RFI responses.
• Strong knowledge of OWASP Top 10 cloud, application and AI security risks, incident management, third-party risk, and experience in GRC/compliance-automation platforms such as Sprinto, Audit Board, Drata, etc.
• Mandatory working knowledge of AI governance, including lifecycle risk, data quality, monitoring, fairness, explainability, transparency, accountability, human oversight, and third-party AI risk.
• Bachelor's degree in Information Security, Computer Science, or related field; Master's preferred.
• Certifications such as ISO 27001 Lead Auditor/Implementer, CISA, CISM, or CISSP preferred; ISO/IEC 42001 and privacy certifications are advantageous.
• Strong analytical, communication, stakeholder-management, leadership, and mentoring skills.