Manager - Security Due Diligence & RFP Governance

Location: Mumbai

Experience: 7 - 12 Years

About the Role:

We are looking for an experienced professional to manage security due diligence and information assurance requirements for a global financial services business.

The role focuses on translating complex cybersecurity, technology risk, and regulatory information into accurate, client-ready responses for due-diligence questionnaires (DDQs), requests for proposals (RFPs), and third-party security assessments.

The incumbent will serve as a central point of coordination between corporate IT, information security, governance, risk and compliance, legal, and engineering teams.

This position also involves strengthening the organization's knowledge base, leveraging AI-assisted documentation tools, and developing scalable response practices to support client onboarding and ongoing business relationships.

Key Responsibilities:

1. Security Due Diligence & Client Assurance:

- Manage incoming security questionnaires, due-diligence requests, and proposal documentation from initial assessment through submission and closure.

- Interpret client inquiries concerning cybersecurity safeguards, technology operations, data protection, business continuity, and organizational risk management.

- Develop technically accurate responses by gathering evidence from internal policies, control descriptions, audit documentation, certifications, and approved security disclosures.

- Translate complex technical and governance concepts into clear, appropriately qualified explanations for institutional clients and prospective business partners.

- Identify incomplete evidence, conflicting statements, or unsupported claims before responses are shared externally.

- Maintain consistency between client-facing disclosures and the organization's established security posture, compliance commitments, and approved documentation.

- Coordinate clarification requests and manage response revisions arising from client reviews or additional assessment requirements.

2. Information Security & Control Documentation:

- Interpret security and compliance requirements under frameworks such as ISO 27001, SOC 2, and the NIST Cybersecurity Framework.

- Connect client assessment criteria with applicable internal controls, policies, procedures, and supporting evidence.

- Work with governance and security specialists to confirm control ownership, implementation status, and the validity of compliance-related statements.

- Identify gaps in available documentation and coordinate with relevant owners to obtain updated evidence or approved explanations.

- Support the preparation and maintenance of security narratives covering access management, incident response, vulnerability management, data handling, and technology risk.

- Ensure sensitive information is handled appropriately and that external disclosures follow internal authorization requirements.

3. Cross-Functional Coordination:

- Partner with the CISO organization, GRC specialists, legal counsel, engineering teams, and regional business representatives to collect verified information.

- Establish clear ownership and response deadlines for questions requiring technical investigation or management approval.

- Facilitate resolution of conflicting inputs and escalate material security or compliance queries to the appropriate decision-makers.

- Coordinate contributions across international teams while accounting for differences in regional requirements and documentation practices.

- Support French-language translation and localization workflows, ensuring translated materials remain consistent with approved source content.

4. Documentation Governance & Knowledge Management:

- Administer a structured library of approved responses, security evidence, policy references, and supporting documentation.

- Implement version-control practices, review schedules, ownership records, and approval tracking for reusable content.

- Identify outdated or duplicative responses and coordinate updates with subject-matter experts.

- Establish documentation standards covering terminology, response structure, evidence references, and quality expectations.

- Maintain traceability between questionnaire requirements, source documents, internal control owners, and final submitted answers.

- Develop reusable content frameworks that reduce repetitive drafting while preserving accuracy across different client assessments.

5. AI Enablement & Process Improvement:

- Use the organization's internal AI platform to support content discovery, preliminary response drafting, document summarization, and response optimization.

- Validate AI-generated material against approved source documents and subject-matter expert inputs before incorporating it into external deliverables.

- Identify opportunities to streamline repetitive questionnaire tasks through standardized templates, automated content retrieval, and workflow improvements.

- Assess recurring bottlenecks in the response lifecycle and recommend practical changes to improve turnaround time and documentation quality.

- Support the development of operating procedures for AI-assisted writing, including verification requirements and appropriate handling of confidential information.

6. Quality Assurance & Team Development:

- Conduct detailed reviews of completed DDQs, RFP responses, and security assessment submissions for accuracy, completeness, readability, and consistency.

- Ensure responses address the actual intent of each question rather than relying on generic or unrelated standard statements.

- Track submission schedules, outstanding dependencies, review status, and recurring quality issues across active requests.

- Guide junior analysts on security terminology, evidence validation, technical writing, and questionnaire interpretation.

- Share best practices to improve response quality, reduce rework, and establish a dependable documentation process.

Required Qualifications:

- 7 - 12 years of experience in DDQ/RFP management, security assurance, governance, risk and compliance, vendor risk management, or information security documentation.

- Strong working knowledge of ISO 27001, SOC 2, and the NIST Cybersecurity Framework.

- Demonstrated ability to interpret cybersecurity controls, internal policies, audit evidence, and compliance documentation.

- Excellent technical writing and editing skills, with the ability to communicate security concepts accurately to non-technical audiences.

- Experience coordinating questionnaire responses across multiple departments and international stakeholders.

- Strong documentation management skills, including content governance, version control, evidence tracking, and approval workflows.

- Ability to evaluate the accuracy and relevance of AI-assisted content and verify statements against authoritative internal sources.

- Excellent organizational skills and the ability to manage several concurrent client requests with competing deadlines.

- Sound judgement in handling confidential information, identifying unsupported claims, and escalating material risks.

- Strong interpersonal skills and the ability to influence contributors without direct reporting authority.

Preferred Qualifications:

- Experience supporting security assessments for global financial institutions, asset managers, investment firms, or other regulated organizations.

- Familiarity with third-party risk assessments, client onboarding controls, and enterprise security assurance processes.

- Exposure to questionnaire automation platforms, knowledge management systems, or AI-enabled content generation tools.

- Experience coordinating French translation or multilingual documentation workflows.

- Previous responsibility for mentoring analysts or improving the operating model of a centralized DDQ/RFP function