Job description

Roles and Responsibilities

1. Governance & Audit Coordination

Act as the single point of coordination for: Internal, External, and Regulatory Audits (IRDAI, CERT-IN, ISO 27001, etc.)
Third-party / OEM assessments
Ensure all audit artifacts are readily available, including: Network diagrams, SOPs, access logs, change management records
Evidence for controls: SOC, VAPT, Red Team, NAC, Firewall, PAM, WAF, OS patching, etc.
Schedule, support, and track walkthroughs, RCA documentation, and evidence submissions
Maintain version-controlled audit folders (digital repository for all audits)
Track and report the status of all audit observations, exceptions, and closures

2. Compliance & Risk Tracking

Maintain and update central trackers for: VAPT / Red Team / Risk Assessment findings
Firewall / WAF / DDoS / NAC / PAM control status
OS patching, versioning, and EOL software compliance
SOC / SIEM / DLP alerts and RCA status
Application and infrastructure compliance status across DC, DR, Cloud
Conduct and support comprehensive IT and cybersecurity risk assessments across all departments, including: Application Development and Support
Infrastructure (DC/DR/Cloud)
End-User Computing
Third-party/Vendor dependencies
Finance, HR, and other business-facing departments with tech exposure
Identify key risks, rate their likelihood and impact, and record mitigation strategies or risk acceptances in a centralized risk register
Ensure alignment of departmental risk assessments with: Organization-wide Risk Appetite
Regulatory and compliance requirements (e.g., IRDAI, CERT-IN)
Audit observations and ongoing security initiatives
Coordinate with department heads and security leads to validate and update risks on a quarterly basis
Support preparation of risk dashboards and summary reports for CIO, CITSO, CISO, and Audit Committees.

3. Third-Party Governance (Including MSA / NDA Tracking)

- Maintain repository and tracking for all third-party legal and compliance documents, including: MSA (Master Service Agreements)
- NDA (Non-Disclosure Agreements)
- Security compliance clauses, data handling policies, and risk assessments
- Ensure validity, renewal status, and exceptions are up to date
Coordinate with legal/procurement/infosec teams for timely updates or clarifications
Provide these documents on demand during audits or vendor reviews

4. Reporting & Communication

- Weekly and monthly dashboards for: Status of audit, VAPT, and compliance observations
- High-priority items pending closure
- Risk register and exception summaries
- Regular communication with: CIO / CISO / CITSO
- Application and Infra Heads
- Third-party and OEM contacts (as required)

5. Documentation Ownership

- Maintain up-to-date, structured, and version-controlled documentation for: All audit and regulatory submissions
- Evidence for compliance controls
- MSA/NDA and third-party assessments
- Ensure all documents are readily available for internal reviews or surprise audits

6. Collaboration & Support

Join CAB/ARB reviews and flag control-related exceptions
Participate in governance meetings, prepare MOMs, and track action items
Work with DC/DR/Cloud teams to maintain audit readiness

Candidate Consent & DPDP Act Compliance

By applying for this position, the candidate acknowledges and consents to the collection, processing, storage, use, and sharing of their personal data and documents for recruitment, background verification, onboarding, and other employment-related purposes, in accordance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and applicable rules. The candidate understands that such data may be retained for as long as necessary for these purposes and acknowledges their rights in relation to their personal data as provided under applicable law.

Someone shared one job with you. ASAI keeps finding the rest.

Scored, not searched. Every role ranked against your actual profile.

Alerts as often as hourly. Reach new roles while the pile is still small.

Skill gaps, spelled out. See exactly which requirements you don't meet yet.

Verified jobs, only. Say no to ghost jobs. Your time deserves respect.