Governance, Risk and Compliance (GRC) Lead

We are seeking an experienced Governance, Risk & Compliance (GRC) Lead to spearhead thedesign, implementation, and maintenance of our ISO 27001 Information Security ManagementSystem (ISMS). This is a hands-on leadership role responsible for establishing a robust securitygovernance framework, achieving ISO 27001 certification, and embedding a culture ofcontinuous security improvement across the organization.Key Responsibilities● ISMS Implementation & Certification: Lead end-to-end ISO 27001 implementationfrom gap analysis through to successful Stage 1 and Stage 2 certification audits;manage external auditor relationships● Risk Management: Develop and operationalize the information security riskmanagement framework; conduct risk assessments, treatment planning, and riskacceptance processes.● Policy & Governance : Author, approve, and maintain the Statement of Applicability(SoA), information security policies, standards, and procedures aligned with ISO 27001Annex A controls.● Control Implementation: Translate ISO 27001 Annex A controls into operationalsecurity measures; coordinate with IT, Accounts, HR, Backoffice, and business units toimplement and validate controls.● Compliance Monitoring: Establish continuous monitoring, internal audit programs, andKPIs/KRIs to measure ISMS effectiveness; manage non-conformities and correctiveactions.● Third-Party Risk: Oversee vendor security assessments and ensure supply chainsecurity controls meet organizational and ISO 27001 standards.● Stakeholder Management: Report ISMS performance, risks, and compliance status tosenior leadership and the board; act as primary liaison for external auditors andregulators.Required Qualifications● 5+ years of experience in information security governance, risk, and compliance● Proven track record of leading at least one full ISO 27001:2022 certification cycle (gapanalysis → certification)● Deep expertise in ISO 27001:2022 standard, Annex A controls, and ISMSdocumentation requirements● Strong understanding of risk assessment methodologies (e.g., ISO 27005, NIST RMF,OCTAVE, FAIR)● Familiarity with internal audit practices and managing external certification bodies● Excellent stakeholder management and ability to influence across technical and non-technical teams● Strong documentation and communication skills — able to translate complex standardsinto actionable guidancePreferred Qualifications● Experience implementing ISMS in fintech, healthcare, or regulated industries● Experience with SOC 2, GDPR, NIST CSF, PCI-DSS, or other compliance frameworks● Background in cloud security (AWS, Azure, GCP) and DevSecOps environments● Knowledge of automation for compliance evidence collection and control testing● Certifications: CISM, CRISC, CISA, ISO 27001 Lead Auditor, or ISO 27001 LeadImplementerWhy Join Us● Opportunity to build the security governance function from the ground up● High-visibility role with direct impact on customer trust and market differentiation● Collaborative environment that values security as a business enabler, not a blockerCompany Profile:We are a one-stop financial services shop, widely known for quality of its advice, personalizedservice and cutting-edge technology. We started our journey in 2008. Currently we are servingmore than 50,000 investors with a team of 100 members. Our core product offering is mutualfund, FD, Govt. Bonds, Debenture, etc.