Assistant. Vice President – IT Governance, Risk & Compliance (IT GRC)

The AVP – IT GRC is responsible for providing leadership and oversight for the organization's IT governance, technology and cyber risk management, regulatory compliance, assurance, cyber resilience and management reporting framework.

• Lead the IT/Information Security GRC governance framework and ensure alignment with organizational objectives, regulatory expectations and risk appetite.
• Oversee periodic review and lifecycle management of IT, Information Security, Cybersecurity and related policies, standards, procedures and SOPs.
• Ensure regulatory requirements are appropriately translated into policies, control requirements and accountable implementation actions.
• Establish appropriate governance mechanisms for tracking policy deviations, exceptions and remediation actions.
• Drive consistency between policies, operating procedures, actual controls and audit/regulatory evidence.

• Lead assessment of regulatory circulars, advisories and directions affecting IT, cybersecurity, operational resilience and technology risk.
• Perform/oversee regulatory applicability and gap assessments and establish accountable action plans for identified gaps.
• Coordinate major regulatory submissions relating to areas such as:
  • Cybersecurity
  • System and Network Audit
  • VAPT
  • Red Team assessments
  • IT & Cyber Risk Assessments
  • Cloud
  • AI/ML
  • CCI/SOC efficacy
  • Technical glitches and cyber incidents
• Coordinate regulatory inspections, including PIQ responses, evidence collation, stakeholder reviews and closure tracking.
• Coordinate communications with applicable authorities and ecosystem stakeholders.

• Provide oversight of enterprise IT and cybersecurity risk assessment programmes.
• Ensure technology risks are identified based not only on regulatory compliance but also on actual threat, business and technology context.
• Maintain management visibility over material risks, control gaps, accepted risks and remediation plans.
• Challenge risk assessments and ensure mitigation plans are proportionate to business and technology exposure.
• Integrate emerging technology risks, including cloud and AI-related risks, into the technology risk-management framework.

• Cybersecurity audits
• System and Network audits
• ITGC audits
• IT & Cyber Risk assessments
• ISO 27001
• ISO 22301
• ISO 9001, where applicable
• CCI/SOC efficacy assessments
• Internal and external assurance exercises
• Regulatory inspection requirements

• Provide governance oversight for cyber resilience, business continuity and disaster recovery requirements.
• Review resilience risks, BCP/DR controls, risk assessments and supporting evidence.
• Ensure identified resilience gaps are appropriately escalated and tracked.
• Support alignment of resilience practices with applicable regulatory requirements.
• Oversee governance of resilience testing and management reporting.

• Provide governance oversight over compliance with the applicable Cyber Security and Cyber Resilience Framework and related requirements.
• Monitor major compliance gaps and implementation programmes.
• Ensure critical cybersecurity risks, control weaknesses and recurring observations receive appropriate management attention.
• Coordinate assurance and reporting requirements supporting cybersecurity maturity and resilience.

• Provide governance oversight over technology and cybersecurity risks associated with third parties and service providers.
• Ensure risk-based due diligence is undertaken for relevant vendors.
• Monitor significant third-party control gaps and remediation actions.
• Coordinate with IT, procurement, business, legal and Information Security stakeholders on vendor-risk requirements.
• Ensure third-party cybersecurity and resilience risks are incorporated into the overall GRC framework.

• Provide senior management with a consolidated view of technology, cybersecurity, compliance and operational-resilience risks.
• Prepare and review management and governance committee papers.
• Present material risks, regulatory developments, audit findings, compliance status and overdue remediation matters in a decision-oriented manner.
• Ensure decisions and action items arising from governance forums are appropriately tracked.

• Provide oversight for cybersecurity and information-security awareness programmes.
• Promote risk ownership and accountability among IT and business stakeholders.
• Support phishing-awareness exercises, employee awareness programmes and relevant ecosystem/DP training.
• Strengthen understanding of regulatory and cybersecurity responsibilities across stakeholders.

• CISA – Certified Information Systems Auditor
• CRISC – Certified in Risk and Information Systems Control
• CISM Certified Information Security Manager
• CISSP – Certified Information Systems Security Professional
• ISO 27001 Lead Auditor / Lead Implementer
• ISO 22301 Lead Auditor / Lead Implementer
• Relevant risk-management/governance certifications

• Significant experience in IT governance, cybersecurity, IT risk, regulatory compliance, audit or technology assurance.
• Experience within financial services, securities markets, banking, market infrastructure or another highly regulated environment would be strongly preferred.
• Demonstrated experience interacting with auditors, senior management and regulatory/compliance stakeholders.

• IT Governance & Technology Risk
• Cybersecurity Governance
• Regulatory Compliance Management
• Audit & Assurance
• Cyber Resilience / BCP / DR
• Third-Party Risk Management
• ITGC and control frameworks
• Regulatory gap assessment
• Incident governance
• Risk and compliance reporting

• Regulatory interpretation and judgement
• Risk-based decision making
• Executive communication
• Senior stakeholder management
• Team leadership
• Negotiation and influencing
• Analytical thinking
• Structured problem solving
• Ability to challenge constructively
• Strong documentation and presentation capability