Key Responsibilities
1. Governance & Audit Coordination
• Act as the single point of coordination for: Internal, External, and Regulatory
Audits (IRDAI, CERT-IN, ISO 27001, etc.)
• Third-party / OEM assessments
• Ensure all audit artifacts are readily available, including: Network diagrams, SOPs,
access logs, change management records
• Evidence for controls: SOC, VAPT, Red Team, NAC, Firewall, PAM, WAF, OS
patching, etc.
• Schedule, support, and track walkthroughs, RCA documentation, and evidence
submissions
• Maintain version-controlled audit folders (digital repository for all audits)
• Track and report the status of all audit observations, exceptions, and closures
2. Compliance & Risk Tracking
• Maintain and update central trackers for: VAPT / Red Team / Risk Assessment
findings
• Firewall / WAF / DDoS / NAC / PAM control status
• OS patching, versioning, and EOL software compliance
• SOC / SIEM / DLP alerts and RCA status
• Application and infrastructure compliance status across DC, DR, Cloud
• Conduct and support comprehensive IT and cybersecurity risk assessments
across all departments, including: Application Development and Support
• Infrastructure (DC/DR/Cloud)
• End-User Computing
• Third-party/Vendor dependencies
• Finance, HR, and other business-facing departments with tech exposure
• Identify key risks, rate their likelihood and impact, and record mitigation
strategies or risk acceptances in a centralized risk register
• Ensure alignment of departmental risk assessments with: Organization-wide Risk
Appetite
• Regulatory and compliance requirements (e.g., IRDAI, CERT-IN)
• Audit observations and ongoing security initiatives
• Coordinate with department heads and security leads to validate and update
risks on a quarterly basis
• Support preparation of risk dashboards and summary reports for CIO, CITSO,
CISO, and Audit Committees.
3. Third-Party Governance (Including MSA / NDA Tracking)
• Maintain repository and tracking for all third-party legal and compliance documents,
including: MSA (Master Service Agreements)
• NDA (Non-Disclosure Agreements)
• Security compliance clauses, data handling policies, and risk assessments
• Ensure validity, renewal status, and exceptions are up to date
• Coordinate with legal/procurement/infosec teams for timely updates or clarifications
• Provide these documents on demand during audits or vendor reviews
4. Reporting & Communication
• Weekly and monthly dashboards for: Status of audit, VAPT, and compliance observations
• High-priority items pending closure
• Risk register and exception summaries
• Regular communication with: CIO / CISO / CITSO
• Application and Infra Heads
• Third-party and OEM contacts (as required)
5. Documentation Ownership
• Maintain up-to-date, structured, and version-controlled documentation for: All audit and
regulatory submissions
• Evidence for compliance controls
• MSA/NDA and third-party assessments
• Ensure all documents are readily available for internal reviews or surprise audits
6. Collaboration & Support
• Join CAB/ARB reviews and flag control-related exceptions
• Participate in governance meetings, prepare MOMs, and track action items
• Work with DC/DR/Cloud teams to maintain audit readiness
Candidate Consent & DPDP Act Compliance
By applying for this position, the candidate acknowledges and consents to the collection, processing, storage, use, and sharing of their personal data and documents for recruitment, background verification, onboarding, and other employment-related purposes, in accordance with the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and applicable rules. The candidate understands that such data may be retained for as long as necessary for these purposes and acknowledges their rights in relation to their personal data as provided under applicable law.