Associate Manager II - Information Security (GRC) [L6]

Perseverance, Passion and Commitment

Obsession with high quality results

Resilience and Adaptability

Key responsibilities

As Navi operates in the regulatory space, this role requires interpreting and helping implement regulations related to cyber security by Reserve Bank of India, IRDAI and SEBI, as well as any other applicable regulatory guidance related to the service offerings issued by relevant institutions
Further to the point above, ensure on-going monitoring and compliance with existing regulatory expectations across these dimensions
Ensuring that information security principles, policies, frameworks, standards and controls are defined, implemented and managed effectively.
Partner and collaborate extensively with cross-functional teams, such as Engineering, Infrastructure, IT, Legal, and help minimize information security risks
Architect and deliberate on the solutions that are compliant with relevant regulatory cybersecurity requirements
Conduct and review results of Technology Risk Assessment, recommending mitigation strategies to bring the Risk to appropriate levels Naviis looking for aAssociate Manager Information Security to be part of the information security
Ensure readiness of the organization for internal and external audits by keeping all documents, evidences, ready
If required, represent Navi in Board and Board Committee meetings, as well as in discussions with regulators
Conduct Security awareness programs, train personnel on data security privacy related processes and responsibilities
Review / conduct Third Party Risk Assessments Vendor assessments before onboarding
Review security solutions / controls implemented by Tech / Engineering teams, controls at data center, cyber / information security incidents, IT BCP and DR drills, cloud security controls
Identify and define Security KPIs including weekly, monthly reports and update Security Dashboards

Required Skills

4 -7 years of experience working in information security or compliance
Prior experience in the Fintech/Startup industry and knowledge of one of the regulatory compliances like PCI DSS, RBI Master Directives, IRDA, SEBI cyber security guideline is required
Hands-on approach in solving complex security problems
Experience with Cyber Security Risk Management frameworks like ISO27001, NIST SP 800-37, etc Cyber Kill Chain, MITRE ATT&CK, or other relevant frameworks
Working knowledge of Cloud environments like AWS, GCP is beneficial
Exposure to Agile methodologies, DevOps, Cloud technologies is beneficial
Ability to multi-task and meet deadlines, and to prioritize in a highly dynamic workenvironment
Ability to balance risk, potential impact, resourcing, business drivers, and timelines
Excellent verbal and written communication skills