ಕೆಲಸದ ವಿವರ

Role Overview

The Governance, Risk & Compliance (GRC) Lead will own and steer the organization’s cybersecurity governance, risk, and compliance agenda. This position is responsible for ensuring security controls are implemented effectively, compliance obligations are met, and governance practices keep improving over time.

The role acts as the main point of contact for cybersecurity governance and regulatory compliance, partnering with executive leaders, business teams, auditors, and technology stakeholders to strengthen control environments, manage cyber risk, support audit readiness, and sustain ongoing compliance.

Governance and Security Frameworks

Direct the cybersecurity governance function across the organization.
Create, run, and continuously improve the Information Security Management System (ISMS).
Maintain adherence to the National Cybersecurity Authority (NCA) Essential Cybersecurity Controls (ECC), NIST Cybersecurity Framework (CSF), NIST SP 800-53, ISO/IEC 27001, ISO/IEC 27002, and ICAO Cybersecurity Standards where relevant.
Draft and update cybersecurity policies, standards, procedures, and governance records.
Chair or support governance forums and Security Steering Committee sessions.
Carry out cybersecurity maturity reviews and translate findings into improvement roadmaps.
Make sure governance activities support business goals and regulatory commitments.

Risk Management

Lead the enterprise cybersecurity risk management process.
Keep the organization’s cyber risk register accurate and current.
Perform cyber risk evaluations and facilitate risk workshops with business stakeholders.
Review risk treatment proposals and approve or recommend risk acceptance where appropriate.
Track remediation work through to completion and closure.
Build and monitor Key Risk Indicators (KRIs).
Prepare executive-level updates on the company’s cyber risk position.

Compliance and Assurance

Manage internal and external cybersecurity audits end to end.
Coordinate assessment activities against NCA ECC, NIST, ISO/IEC 27001, and ICAO requirements.
Oversee security control testing and compliance validation.
Organize evidence gathering and ensure the organization remains audit-ready.
Follow up on audit observations and corrective actions until resolved.
Assist with third-party risk reviews and vendor security evaluations.

Policies, Standards, and Awareness

Develop and maintain information security policies, standards, procedures, and guidance documents.
Run policy review and approval workflows.
Assess security exceptions and compensating control arrangements.
Promote awareness of governance and compliance expectations across teams.
Keep documentation aligned with current regulatory and internal requirements.

Reporting and Metrics

Build executive dashboards and governance reports.
Track and report cybersecurity KPIs and KRIs.
Present governance, compliance, and risk updates to senior leadership.
Summarize compliance status, audit outcomes, enterprise risk, security maturity, control effectiveness, and remediation progress.

Required Background

Candidates should hold a bachelor’s degree in Cybersecurity, Information Security, Information Technology, Risk Management, Business Administration, or a closely related field. A minimum of 7 years of experience in GRC, information security, audit, or cybersecurity is required, including at least 3 years in a senior or leadership GRC position. The role also calls for practical experience in building and managing enterprise GRC programs, performing cybersecurity risk assessments, maintaining risk registers, and leading internal and external audits. Strong familiarity with cybersecurity governance frameworks and regulatory compliance is essential.

Technical Expertise

The role calls for solid hands-on capability in cybersecurity governance, enterprise risk management, risk register administration, security control assessments, compliance reviews, audit coordination, policy and standards creation, third-party risk management, and ISMS management. Working knowledge of NCA ECC, NIST CSF, NIST SP 800-53, ISO/IEC 27001, ISO/IEC 27002, and ISO 31000 is expected. Strong reporting ability using Microsoft Excel, Microsoft Power BI, and the Microsoft Office suite is also important.

Preferred Experience

Helpful background includes work in government, aviation, telecommunications, financial services, or other tightly regulated sectors. Experience supporting ICAO cybersecurity compliance or aviation regulatory environments is an advantage. Prior use of GRC tools such as ServiceNow GRC, RSA Archer, OneTrust, MetricStream, or AuditBoard is preferred. Additional value comes from experience with ISO/IEC 27001 certification or surveillance audits, supplier security assessments, third-party risk programs, and familiarity with COBIT and CIS Critical Security Controls.

Preferred Certifications

CISSP (Certified Information Systems Security Professional)
CRISC (Certified in Risk and Information Systems Control)
CISA (Certified Information Systems Auditor)
CGRC (Certified in Governance, Risk and Compliance)
ISO/IEC 27001 Lead Implementer
ISO/IEC 27001 Lead Auditor
COBIT Foundation

Compliance Manager

ನೀವು ಎಲ್ಲಿ ಕೆಲಸ ಮಾಡುತ್ತೀರಿ