Head - IT Governance, Risk & Compliance (GRC)

Position Details

Role Title: Head - IT Governance, Risk & Compliance (IT GRC)

Function: Information Technology / Risk Management

Reporting To: Head - IT Risk, Program Management and Transformation

Level: Vice President (Head of Function)

Industry: BFSI / NBFC / FinTech

Role Purpose

The Head of IT Governance, Risk & Compliance (GRC) will lead the organization's technology governance, risk management, regulatory compliance, audit management, and operational resilience programs. The role is responsible for ensuring that technology operations comply with RBI and other regulatory requirements while maintaining an effective control environment and robust risk management framework across the enterprise.

Ideal Candidate

A seasoned GRC leader with deep expertise across BFSI / NBFC technology governance, risk, compliance, audit, and cyber risk oversight, capable of leading enterprise-wide GRC programs, managing regulatory relationships, and influencing executive and board-level stakeholders while driving a strong governance and risk culture across the organization.

Key Responsibilities

Governance & Leadership

- Define and execute the enterprise-wide IT GRC strategy aligned with business objectives and regulatory requirements.

- Establish and maintain governance frameworks, policies, standards, and operating procedures.

- Lead IT Governance, Risk, Compliance, and Audit forums and provide periodic updates to Executive Management and Board Committees.

Regulatory Compliance & Audit Management

- Lead all technology-related regulatory inspections and audits including RBI, CSITE, IS Audit, ITGC, IFC, Statutory, Internal and Cyber Security Audits.

- Ensure compliance with RBI, NPCI, UIDAI, CERT-In, and other applicable regulatory requirements.

Technology Risk Management

- Own and manage the enterprise IT Risk Management Framework.

- Drive identification, assessment, mitigation, monitoring, and reporting of technology risks.

- Govern risk acceptance, remediation plans, and control effectiveness reviews.

Information Security Governance

- Provide governance oversight for Information Security and Cyber Risk programs.

- Ensure effective management of security vulnerabilities, risk assessments, VAPT observations, and security audit findings.

- Support compliance with ISO 27001, ISO 27701, RBI Cyber Security Framework, and industry best practices.

Operational Resilience & Business Continuity

- Lead Business Continuity Planning (BCP), Disaster Recovery (DR), and Operational Resilience programs.

- Oversee Business Impact Assessments (BIA), DR drills, and resilience testing.

- Ensure critical business services meet recovery and resilience objectives.

Third-Party Risk & Vendor Governance

- Establish and manage vendor governance and third-party risk management frameworks.

- Lead vendor due diligence, security assessments, self-assessments, and audits.

- Ensure compliance with RBI Outsourcing and Third-Party Risk Management Guidelines.

Continuous Improvement & Transformation

- Drive GRC transformation initiatives, process improvements, and governance automation.

- Monitor emerging regulatory requirements and industry trends.

- Strengthening controls, optimize compliance processes, and improve organizational risk maturity.

Desired Candidate Profile

Experience

- 18+ years of overall experience in IT Governance, Risk Management, Compliance, Technology Audit, Information Security, and Operational Risk.

- Minimum 8 - 10 years in leadership roles managing enterprise-wide GRC functions.

- Strong experience in Banking, NBFC, BFSI, or FinTech organizations.

- Proven experience handling RBI inspections, regulatory audits, technology governance, and risk management programs.

- Experience with Big 4 consulting firms is must.

Functional Expertise

- IT Governance, Enterprise Risk Management, Information Security Governance

- Regulatory Compliance, IT Audit & Controls

- Technology Risk Management, Operational Risk Management

- BCP & Disaster Recovery, Third-Party Risk Management

- RBI Regulatory Frameworks

Leadership Competencies

- Strategic Leadership

- Executive Stakeholder Management

- Regulatory Engagement

Education

- B.E. / B.Tech. / MCA / M.Tech in Computer Science, Information Technology, or related discipline.

- MBA preferred.

Certifications (Preferred)

- CISA / CISSP / CISM / CRISC / CGEIT