Manager, Information Security Management
Rakuten Symphony · Telecom
- RSIN_Bangalore
- On-site
- Posted today
- Apply by 25 Nov
- Cybersecurity
About the job
Job Description:
Job Overview
We are seeking a strategic and experienced Information Security GRC (Governance, Risk & Compliance) Manager to lead and mature our enterprise-wide GRC program across information security, data privacy, and telecommunications regulatory compliance. This role owns the design, execution, and continuous improvement of the GRC function — managing a team of specialists, driving risk-informed decision-making, and serving as a trusted advisor to senior leadership and the CISO.
The ideal candidate brings deep expertise in security frameworks, regulatory landscapes, and telecom-specific compliance requirements, combined with the leadership capability to build high-performing teams and influence cross-functional stakeholders at all levels.
Responsibilities & Duties
GRC Program Leadership
Own and drive the organization's GRC strategy, roadmap, and operating model across information security, data privacy, and telecommunications compliance.
Build, lead, and mentor a team of GRC specialists, setting clear objectives, performance expectations, and development plans.
Report program health, risk posture, and compliance status to the CISO and senior leadership on a regular cadence.
Define and track GRC program KPIs and OKRs (Key Performance Indicators / Objectives and Key Results), ensuring measurable outcomes and continuous improvement.
Policy & Standards Governance
Oversee the lifecycle management of the organization's information security, privacy, and telecom compliance policy framework — including development, review, approval, and enforcement.
Ensure policies and standards are aligned with applicable regulatory requirements, industry frameworks (e.g., ISO 27001, NIST CSF), and business objectives.
Establish governance processes to ensure consistent communication, acknowledgment, and enforcement of policies across all business units and personnel.
Risk Management
Lead the enterprise information security risk management program, including periodic risk assessments, risk register maintenance, and risk treatment planning.
Provide risk-based guidance to business and technology stakeholders, translating complex risk findings into clear, actionable recommendations for executive and operational audiences.
Develop and maintain risk appetite and tolerance statements in alignment with organizational strategy, with particular attention to telecom-specific threat vectors (e.g., SS7/Diameter signaling, SIP/VoIP, BGP/DNS, mobile core).
Oversee third-party and vendor risk management processes, ensuring supply chain risks are identified, assessed, and mitigated.
Compliance & Audit Management
Manage the organization's compliance posture across applicable standards and regulations, including ISO 27001, GDPR, telecom-specific regulations, and other relevant frameworks.
Direct and coordinate internal and external audit activities — including scoping, evidence collection, stakeholder preparation, and findings remediation.
Oversee remediation tracking for audit findings and compliance gaps, ensuring timely closure with appropriate accountability.
Serve as the primary point of contact for regulators, external auditors, and certification bodies on all GRC-related matters.
Training & Security Awareness
Oversee the design and delivery of a role-based security awareness and compliance training program, ensuring coverage of telecom-specific regulatory obligations.
Drive a culture of security and compliance awareness across the organization through targeted campaigns, metrics, and executive sponsorship.
Measure training effectiveness and adjust programs based on outcomes and emerging risk areas.
Incident & Crisis Governance
Provide GRC oversight for security, privacy, and telecom compliance incidents — ensuring regulatory notification obligations, documentation requirements, and post-incident review processes are met.
Maintain current knowledge of applicable federal, state, and international privacy laws, telecommunications regulations, and accreditation standards.
Collaborate with the Security Operations and Legal teams to ensure incident response plans reflect regulatory and contractual obligations.
Stakeholder Engagement & Executive Advisory
Act as a trusted advisor to the CISO, executive leadership, and the Board on matters of information security risk, compliance posture, and regulatory change.
Partner with Legal, Finance, HR, Product, Engineering, and Network Operations to embed GRC practices into business processes and technology delivery.
Represent the GRC function in cross-functional governance forums, steering committees, and customer-facing engagements where security assurance is required.
Qualifications
Education
Bachelor's or Master's degree in Information Security, Computer Science, Law, Business Administration, or a related field.
Certifications (one or more preferred)
CISM (Certified Information Security Manager)
CISSP (Certified Information Systems Security Professional)
CISA (Certified Information Systems Auditor)
CIPP (Certified Information Privacy Professional)
ISO 27001 Lead Implementer / Lead Auditor
Additional telecom or risk-focused certifications are a plus
Experience
Minimum 7–10 years of progressive experience in information security, GRC, or a related field.
Minimum 3–5 years in a people management or team leadership role, with demonstrated ability to build and develop high-performing teams.
Proven track record of designing and maturing GRC programs in complex, regulated environments — ideally within telecommunications, enterprise software, or critical infrastructure sectors.
Hands-on experience managing compliance programs against ISO 27001, GDPR, NIST CSF, and telecom-specific regulatory frameworks.
Experience engaging with external auditors, regulators, and certification bodies.
Skills & Competencies
Strategic thinking: Ability to translate regulatory requirements and risk findings into business-aligned programs and roadmaps.
Leadership: Demonstrated ability to lead, influence, and develop teams and cross-functional stakeholders without direct authority.
Communication: Exceptional written and verbal communication skills; able to present complex risk and compliance topics clearly to both technical and executive audiences.
Analytical rigor: Strong risk assessment, problem-solving, and data-driven decision-making capabilities.
Telecom domain knowledge: Familiarity with telecom network security concepts, signaling protocols, and sector-specific regulatory obligations is highly desirable.