Job description

The Impact You’ll Drive

We're looking for an experienced GRC professional to build and scale our governance, risk, and compliance function. As a fintech infrastructure provider processing sensitive financial data on behalf of banks and NBFCs, we operate under significant regulatory scrutiny - this role will own the frameworks, certifications, and controls that keep Vegapay compliant, secure, and trusted by our regulated BFSI partners. You’ll work closely with Security, Engineering, Legal, Product, and leadership to embed governance and risk management into how we build and operate, while being the primary point of contact for client and auditor assurance.

The Hats You Will Wear

Governance & Policy Management

Design, implement, and maintain information security and compliance policies, standards, and procedures aligned to ISO 27001, SOC 2, PCI-DSS, and RBI guidelines
Establish and run governance forums (risk council, policy reviews) with leadership and cross-functional stakeholders
Own and maintain the organization’s risk register, control framework, and compliance calendar
Conduct periodic enterprise and IT risk assessments, identifying gaps and driving remediation with process and engineering owners
Define and track key risk indicators (KRIs) and key control indicators (KCIs) across the business
Support risk-based decision-making for new products, partnerships, and vendor relationships

Risk Management

Ensure ongoing compliance with RBI guidelines, payment ecosystem regulations (NPCI, card network mandates), and data protection requirements including the DPDPA
Track regulatory and industry changes impacting fintech/BFSI operations and translate them into actionable requirements
Liaise with regulators, external auditors, and banking/NBFC partners on compliance matters as needed
Own and coordinate RBI-related audits and regulatory inspections, including evidence submission, query resolution, and remediation tracking

Information Security Compliance & Audits

Own end-to-end delivery of ISO 27001, SOC 2 Type II, PCI-DSS, and other certification audits — including evidence collection, auditor coordination, and remediation tracking
Partner with Engineering and Security to embed controls into product and infrastructure design
Drive closure of audit findings and monitor control effectiveness over time

Vendor & Third-Party Risk Management

Design and operate a vendor/third-party risk assessment program covering onboarding due diligence, periodic reviews, and offboarding
Review vendor contracts and SLAs for risk, security, and compliance clauses in partnership with Legal

Client & Stakeholder Assurance

Respond to security and compliance due-diligence questionnaires and audits from banking and NBFC clients
Represent Vegapay’s GRC posture in client and partner conversations, building trust with regulated BFSI customers
Prepare compliance dashboards, risk reports, and leadership/board updates

The Perfect Fit

Bachelor’s degree in Engineering, Technology, Business, or a related field; advanced degree is a plus
6–8 years of experience in Governance, Risk & Compliance, Information Security Compliance, IT Audit, or related roles — preferably within fintech, BFSI, SaaS, or payments
Hands-on experience implementing and managing ISO 27001, SOC 2, and PCI-DSS programs, including leading external audits to closure
Working knowledge of RBI regulations, payment ecosystem guidelines, and data protection laws (DPDPA/GDPR)
Experience building and operating vendor/third-party risk management programs
Strong stakeholder management skills, with the ability to work across Security, Engineering, Legal, and business teams
Excellent written and verbal communication skills, including policy writing and executive-level reporting

Your Edge Over the Rest

Professional certifications such as CISA, CRISC, CISSP, CISM, or ISO 27001 Lead Auditor/Implementer
Prior experience in a regulated financial services, payments, or banking technology environment
Exposure to cloud security governance (AWS/GCP) and DevSecOps practices
Experience setting up or scaling a GRC function from the ground up in a startup environment
Familiarity with GRC tooling and compliance automation platforms

The Problem We’re Solving

Financial institutions today are held back by legacy systems that are slow, rigid, and expensive to scale. Launching or evolving credit, lending, and UPI products often takes months, requires heavy engineering effort, and limits the ability to create personalized customer experiences.

At the same time, customer expectations have changed - speed, flexibility, and tailored financial products are no longer optional. Banks and fintechs need infrastructure that allows them to innovate quickly, adapt continuously, and scale without friction.

This is where we come in.

At Vegapay, we are building modern, configurable fintech infrastructure that enables banks, NBFCs, and enterprises to design, launch, and manage credit and payment programs with ease. Our platform brings together flexibility, speed, and control - helping our partners unlock new growth opportunities and deliver personalized banking experiences at scale.

The Opportunity Ahead

Lead and shape high-impact engineering teams building real-world fintech infrastructure
Drive both technical direction and team growth - with real ownership and decision-making authority
Work on complex, scalable systems that directly power banking, credit, and payments
Collaborate with strong product and leadership teams in a fast-moving, execution-first environment

Someone shared one job with you. ASAI keeps finding the rest.

Scored, not searched. Every role ranked against your actual profile.

Alerts as often as hourly. Reach new roles while the pile is still small.

Skill gaps, spelled out. See exactly which requirements you don't meet yet.

Verified jobs, only. Say no to ghost jobs. Your time deserves respect.