Sr. Process Lead - HRO Control & Compliance

Function: HRO - Control & Compliance

Experience: 5 Years

Location: Pune, MH

About the Role

We are looking for a highly analytical and detail-oriented Senior Process Lead - HRO Control & Compliance to drive risk governance, audit excellence, compliance assurance, and information security management across large-scale HR Operations and HRO engagements.

This role is ideal for professionals with strong experience in HR Operations, Internal Audit, Compliance, Information Security Governance, and Risk Management within global delivery/shared services environments. The individual will play a critical role in strengthening operational controls, ensuring regulatory compliance, improving audit readiness, and enhancing overall governance maturity across HRO processes.

The role requires deep understanding of HR operational processes, control frameworks, risk assessment methodologies, ISMS governance, compliance standards, and security controls, combined with strong stakeholder management and analytical capabilities.

Key Responsibilities

Risk, Audit & Compliance Management

- Lead operational, compliance, and process audits across HRO engagements.

- Conduct risk assessments, process walkthroughs, and control evaluations to identify operational and compliance gaps.

- Prepare process documentation including narratives, process flow diagrams, and Risk & Control Matrices (RCM).

- Perform testing of control design and control effectiveness for HR operational and compliance processes.

- Support remediation planning and closure tracking for audit observations, control gaps, and operational failures.

- Ensure compliance with regulatory, contractual, and organizational governance requirements including SOX, GDPR, Data Privacy, ISO 27001, and PCI DSS.

Information Security & ISMS Governance

- Drive Information Security Management System (ISMS) governance activities across HRO and Service Desk engagements.

- Conduct technical and non-technical risk assessments across people, process, and technology dimensions.

- Ensure implementation and monitoring of security controls aligned with organizational policies and client requirements.

- Support deployment, monitoring, and reporting of security controls in collaboration with cross-functional teams.

- Facilitate implementation of ISO 27001 and related information security frameworks at engagement level.

- Lead periodic security awareness initiatives and compliance readiness activities.

Operational Risk & Incident Management

- Execute root cause analysis (RCA) for operational failures, security incidents, process weaknesses, and compliance deviations.

- Track and monitor risk treatment plans, remediation activities, and issue closure governance.

- Analyze incident trends and recommend preventive and corrective control measures.

- Drive continuous improvement initiatives focused on strengthening governance, risk management, and operational controls.

Governance & Stakeholder Management

- Prepare governance reports, audit dashboards, compliance trackers, and remediation updates for internal and external stakeholders.

- Collaborate with delivery teams, corporate risk groups, security functions, and client stakeholders to ensure governance adherence.

- Ensure contractual compliance for client security and governance clauses across transitioned and ongoing engagements.

- Support audit readiness initiatives through evidence management, walkthrough rehearsals, and documentation governance.

Advanced Risk & Security Governance

- Support development and monitoring of metrics and KRIs including MTTD, MTTR, patch SLA adherence, and phishing resilience.

- Contribute to policy governance including policy, standards, baselines, procedures, and exception management.

- Support cloud governance and security compliance initiatives across AWS, Azure, and GCP environments.

- Assist in identity and access governance, segregation of duties (SOD), privileged access management (PAM), and RBAC controls.

- Drive awareness and alignment with evolving cybersecurity, privacy, and compliance standards.

Required Skills & Experience

Must-Have Skills

- 5-7 years of experience in HR Operations, HRO Compliance, Internal Audit, Risk Management, or Information Security Governance.

- Minimum 3-4 years of experience in operational, compliance, or internal audits.

- At least 1 year of supervisory review experience.

- Strong understanding of HRO operational processes including Payroll, Onboarding, Employee Data Management, and Separation.

- Experience in conducting risk assessments, process walkthroughs, control testing, and compliance reviews.

- Good understanding of audit frameworks, compliance controls, and ISMS governance.

- Experience working in global shared services or GBS delivery environments.

- Strong analytical, documentation, and problem-solving capabilities.

- Advanced spreadsheet and reporting skills.

- Excellent written and verbal communication skills.

- Ability to manage multiple priorities independently in fast-paced environments.

Technical Knowledge

- Understanding of SOX, GDPR, Data Privacy, ISO 27001, PCI DSS, and operational risk frameworks.

- Working knowledge of ERP and HR systems such as SAP, Oracle, PeopleSoft, and Workday.

- Understanding of Information Security concepts including ITGC controls, access management, incident management, and vulnerability governance.

- Familiarity with cloud security concepts and governance frameworks across AWS, Azure, and GCP.

- Exposure to SIEM, logging, detection, and security operations governance.

Preferred Qualifications & Certifications

Educational Qualifications

- Graduate in any discipline.

Good-to-Have Qualifications

- Chartered Accountant (CA), HR Audit Certifications, or CHRA programs.

- Relevant post-qualification audit experience.

- Supervisory or review management experience.

Preferred Certifications

- CISA

- CISM

- CIA

- ISO 27001 Lead Auditor / Lead Implementer

- CISSP

- CRISC

- CCSP / CCSK

- Azure Security Engineer (AZ-500)

- Azure Solutions Architect (AZ-305)

- AWS Security Specialty

- Privacy Certifications such as CIPM/CIPP-E

Ideal Candidate Profile

- Highly analytical and risk-aware.

- Strong in governance, audit, and compliance management.

- Comfortable managing complex stakeholder environments.

- Detail-oriented with strong documentation and reporting capabilities.

- Able to balance operational governance with business enablement.

- Passionate about strengthening controls, security posture, and process excellence.

- Experienced in operating within global delivery and client-centric environments.

Key Competencies

- Risk Management & Internal Audit

- Operational Compliance & HR Operations Governance

- Information Security Governance

- Stakeholder Management

- Process Excellence

- Root Cause Analysis

- ISMS Governance

- Analytical Thinking, Communication & Reporting