Senior Lead – Information Security Governance, Risk & Compliance

Senior Lead – Information Security Governance, Risk & Compliance

Department

Corporate Group

Job Description

Accountabilities:

1. Establishing and maintaining Information security program conforming to ISO/IEC 27001:2015 for uplifting the cyber resilience and incident response for CRISIL in compliance to Information Security and Cybersecurity Policy, Common Security Standards, Technical Security Standards, Industry best practices and CISO Directives.

2. Responsible for assisting Head – IS GRC in reporting to CRISIL Management and Risk Committee the critical cyber security threats and vulnerabilities that CRISIL is exposed to, ensuring emerging cyber threats and the bank’s preparedness in response to these threats are reported and discussed in the CRISIL Risk Committee.

3. Support and manage ISO 27001 and SOC2Type2 external and internal audits.

4. Responsible for driving the regulatory compliance for Cyber Security Framework and all current and future advisory notes received from the regulator.

5. Support Head-IS GRC for development of CRISIL Information Security and Cyber Security Policy, Data Governance and Classification Policy, Access Control Policy, Acceptable use of assets and asset management policy etc.

6. Keep abreast with country specific cyber threats through maintaining close work relationship with regulatory agencies CERT-In, attend RBI’s cyber events & trainings

7. Planning and executing periodic cyber breach simulation exercises, make sure CRISIL Branch is well prepared for any cyber breach incidents with widespread impacts.

8. Responsible for developing CRISIL cybersecurity KRIs and KPIs, Monthly reporting of risk KPI, security SMART objectives on monthly basis and presenting the KRIs and KPIs to CRISIL risk committee for independent challenge and management oversight.  

9. Partner with 2nd Line IT and Cyber Risk Management, Country Compliance and Global regulatory compliance activities.  Provide subject matter expert advisory on cybersecurity, security technology, best practice, and regulatory compliance requirements.

10. Support in managing risk remediation activities for CRISIL, ensuring the remediation works are executed in accordance to the approved timeline and deliverables.

11. Manage risks associated with third party suppliers, conduct third party due diligence and ongoing risk management activities in accordance to the bank’s Third-Party Risk Management Framework.
12. Review  training content periodically and keep the content most relevant to the environment and external threats
13. Conduct Information Security awareness training periodically to general staffs and functional leads across the CRISIL
14. Oversee Inter departmental security requirements, Support in client assessments

Education / Experience / Other Information

• Bachelor degree in Engineering or Graduation in Computer Science degree or any other graduation / post graduation
• 8-10 years’ experience in information security, cybersecurity, technology risk management in large multinational financial / technology institutions environment
• ISMS ISO 27001 LI/LA and other Security related certifications viz., CISA / CISM (or equivalent) is an advantage.
• Hand-on experience on Process definitions, process drafting, documentation, conducting and managing audits, knowledge of Data privacy laws of various countries
• Excellent verbal and written communication skills. 

Open Positions

1

Mandatory Skills

ISO 27001,ISMS, SOC2, Audits, Process Streamlining

Education Qualification

B.E, B.Tech, B.Sc,

Experience

8 to 12 Years