Lead Cybersecurity Compliance

About the Role

TAC Infosec Ltd. is looking for an experienced and detail-oriented Lead - Compliance to oversee compliance initiatives, manage information security frameworks, coordinate internal and external audits, and ensure adherence to applicable regulatory requirements and industry standards.

The ideal candidate will have strong expertise in information security compliance, risk management, governance frameworks, audit management, and cybersecurity regulations. The role requires close collaboration with internal teams, clients, auditors, and external stakeholders to maintain a strong compliance posture across business operations and cybersecurity services.

Key Responsibilities :

1. Compliance Management :

- Develop, implement, and maintain compliance policies, procedures, standards, and internal controls.

- Ensure compliance with applicable regulatory requirements, contractual obligations, and industry-specific standards.

- Monitor changes in cybersecurity regulations and compliance requirements and assess their impact on the organization.

- Maintain compliance registers, evidence repositories, risk logs, and documentation for audits and assessments.

- Establish compliance monitoring processes and report compliance gaps to senior management.

2. Information Security Frameworks :

- Lead the implementation, maintenance, and continuous improvement of relevant information security and compliance frameworks, including ISO/IEC 27001, SOC 2, NIST, CIS, GDPR, and CERT-In directions.

- Support readiness assessments, gap analyses, risk assessments, and remediation planning.

- Coordinate with relevant teams to ensure policies and controls are implemented effectively.

3. Audit Management :

- Plan and coordinate internal audits, external audits, certification assessments, and client compliance reviews.

- Prepare audit documentation, evidence, control matrices, and compliance reports.

- Coordinate with auditors and relevant stakeholders to address audit observations and findings.

- Track corrective and preventive actions and ensure timely closure of identified gaps.

- Maintain audit trails and ensure documentation is accurate, complete, and readily available.

4. Risk Management and Governance :

- Conduct compliance risk assessments and identify gaps in existing processes and controls.

- Develop risk mitigation plans and monitor their implementation.

- Maintain risk registers, control assessments, and management reporting.

- Support business continuity, incident response, vendor risk management, and information security governance activities.

- Escalate significant compliance risks and control deficiencies to senior management.

5. Data Protection and Regulatory Compliance :

- Support compliance with applicable data privacy and protection laws, including India's Digital Personal Data Protection Act, 2023, and GDPR.

- Assist in reviewing data processing agreements, confidentiality requirements, privacy policies, and contractual security obligations.

- Coordinate with relevant teams on data handling, retention, access control, and incident reporting requirements.

- Support privacy impact assessments and third-party compliance reviews where required.

6. Client and Business Support :

- Support client security assessments, vendor due diligence, RFPs, security questionnaires, and compliance-related queries.

- Work closely with Sales, Delivery, Product, Engineering, HR, IT, and Legal teams to address compliance requirements.

- Provide compliance inputs for client contracts, security commitments, and business proposals.

- Communicate compliance requirements to internal stakeholders and support client audits and assessments.

7. Team Leadership and Continuous Improvement :

- Lead and mentor compliance team members and coordinate cross-functional compliance activities.

- Conduct compliance awareness sessions and training for employees.

- Establish key compliance metrics and provide periodic reports to management.

- Identify opportunities to automate compliance monitoring, evidence collection, and reporting.

- Promote a culture of accountability, security awareness, and continuous improvement.

Required Qualifications :

- Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Law, Risk Management, or a related field.

- Relevant professional certifications such as ISO 27001 Lead Implementer, ISO 27001 Lead Auditor, CISA, CRISC, or CISM are preferred.

- Strong knowledge of information security governance, risk management, compliance frameworks, and audit methodologies.

Required Experience and Skills :

- 6 - 10 years of experience in information security compliance, GRC, IT audits, cybersecurity governance, or risk management.

- Proven experience implementing or maintaining ISO 27001, SOC 2, or comparable compliance frameworks.

- Experience managing internal and external audits, regulatory assessments, and client compliance reviews.

- Strong understanding of cybersecurity controls, policies, risk assessments, and remediation processes.

- Familiarity with data privacy regulations and third-party risk management.

- Excellent documentation, analytical, communication, and stakeholder management skills.

- Ability to manage multiple compliance initiatives and work effectively across departments.

- Experience with GRC or compliance automation tools is an advantage.

Key Performance Indicators (KPIs) :

- Timely completion of internal and external audits.

- Percentage of compliance gaps and audit findings closed within agreed timelines.

- Maintenance of applicable certifications and compliance requirements.

- Effectiveness of risk mitigation and corrective action plans.

- Accuracy and completeness of compliance documentation and audit evidence.

- Timely completion of client security assessments and compliance questionnaires.

- Employee compliance awareness and training completion rates.

- Improvement in compliance monitoring and reporting efficiency.