Lead - IT Governance

About the role

This role provides independent governance and assurance over the NBFC's technology environment, separate from the IT line, so that end-to-end compliance with RBI IT Governance, Risk, Controls & Assurance Practices and RBI outsourcing directions is ensured. It reviews, challenges and validates the effectiveness of IT controls, outsourcing practices (including cloud and SOC) and resilience measures, while aligning technology risk management to business objectives and risk appetite. The position is based in Mumbai and is full-time.

Key responsibilities

• Act as an independent checker over IT policies, standards and controls, ensuring the IT Governance Framework covers strategic alignment, risk management, resource and performance management, and BCP/DR as required by RBI Master Directions, the DPDP Act and other regulations.
• Maintain a compliance inventory and gap log, drive remediation with accountable owners in IT/InfoSec, and oversee adherence to the Board-approved IT Outsourcing Policy (2LoD).
• Verify a central inventory of IT outsourcing arrangements, their due diligence and contractual safeguards (audit and inspection rights, confidentiality and data protection, data residency, regulatory access, subcontracting controls, BCP/DR, exit and termination, SLA/OLA, performance and risk KRIs), and ensure compliance with renewal and new-contract windows.
• Oversee cross-border outsourcing risk assessments and controls, cloud usage under Appendix I and SOC outsourcing under Appendix II.
• Independently review change management artefacts (risk impact, approvals, testing, rollback, post-implementation validation) and patch governance for critical vulnerabilities.
• Check privileged access controls, SoD, recertifications and teleworking controls, and validate audit trails, logging and monitoring for systems handling critical or sensitive information.
• Review IS/cyber policies, risk assessments, vulnerability assessment and penetration testing cadence, and incident response and CCMP execution, including regulatory reporting readiness.
• Track KRI/KCI thresholds for cyber and IT risks and escalate breaches to relevant authorities in line with risk appetite.
• Oversee the BCP/DR testing calendar, scenario coverage and achievement of RPO/RTO targets.

Required profile

• 8-10 years of work experience.