Head of Governance, Risk and Compliance

About Us:

At apexanalytix, we’re lifelong innovators! Since the date of our founding nearly four decades ago we’ve been consistently growing, profitable, and delivering the best procure-to-pay solutions to the world.   We’re the perfect balance of established company and start-up.  You will find a unique home here. 

And you’ll recognize the names of our clients. Most of them are on The Global 2000. They trust us to give them the latest in controls, audit and analytics software every day.  Industry analysts consistently rank us as a top supplier management solution, and you’ll be helping build that reputation.

Read more about apexanalytix - https://www.apexanalytix.com/about/

Job Details

The Role

apexanalytix is seeking an experienced governance, risk and compliance leader to serve as Head of GRC, based in the United States or in Noida, India. The role reports to the Chief Product & Technology Officer (CPTO), who leads apexanalytix's global engineering, product and hosted IT organizations. As a member of the CPTO's leadership team, the Head of GRC owns the company's control framework, its ISO 27001, SOC 1 and SOC 2 programs, and its enterprise and third-party risk management, and gives independent assurance that the controls run across the organization work as intended.

The role is deliberately independent of the controls it tests. Security Operations, the datacenter, production environments and corporate IT sit with the VP Technology Operations. Product identity and security tooling in the delivery pipeline sit with the Platform team. GRC sets the standards these teams work to, tests whether their controls work, and reports the results directly to the CPTO.

Today the GRC team also runs security operations. Under the new organization design, Security Operations moves to Technology Operations. The Head of GRC leads that handover and then builds GRC into a focused, independent assurance function.

Trusted Advisor

•Advises the CPTO, the executive team and, as needed, the Board or Audit Committee on the company's risk position, compliance obligations and the state of its controls.

•Gives product and engineering leaders an early, clear view of the compliance and risk impact of new products, AI capabilities, architecture changes and acquisitions.

•Acts as the senior voice of security and compliance assurance toward enterprise customers, auditors and regulators.

•Works with Legal, Privacy and Finance to turn regulatory and contractual obligations into practical control requirements.

 The Work - 

Governance and compliance

•Strategy and governance. Defines and runs a multi-year GRC strategy and roadmap. Chairs the company's risk and compliance forums and reports regularly to the CPTO and the executive team.

•Policy framework. Owns security policy and standards, including annual review, exceptions and employee attestation.

•Certifications and audits. Leads the ISO/IEC 27001, SOC 1 Type II and SOC 2 Type II programs and any further attestations the market requires. Manages external auditors and owns audit scope, evidence coordination, findings and remediation tracking.

•Control framework. Maintains a single control framework mapped across NIST CSF, ISO 27001, SOC 2 and CIS, so each control is tested once and used to meet many requirements.

•Regulatory obligations. Tracks obligations across the jurisdictions the company operates in, including GDPR, CCPA/CPRA, DORA, NIS2, the EU AI Act, India's Digital Personal Data Protection Act (DPDP Act) and CERT-In incident reporting rules.

Risk and assurance

•Independent control testing. Sets control requirements and tests how well controls work across Security Operations, Technology Operations, corporate IT, Platform and the product trios. Runs periodic access reviews and segregation-of-duties checks.

•Vulnerability and risk reporting. Monitors vulnerability management and patching against agreed SLAs and escalates breaches directly to the CPTO. Defines and reports key risk indicators for security, availability and access.

•Enterprise risk management. Runs the enterprise and information security risk program: risk identification and assessment, the risk register, treatment plans and named risk owners.

•Incident and resilience oversight. Reviews security incidents after they close to check whether controls worked and notification obligations were met. Sets business continuity and disaster recovery requirements and confirms that the plans owned by Technology Operations are tested.

•Third-party risk. Owns third-party risk management for subprocessors, cloud providers and critical suppliers, from due diligence through ongoing monitoring, using apexanalytix's own supplier risk capabilities where appropriate.

•AI governance. Works with the Head of AI & Data to set governance for models and agents, including risk assessment, guardrails and audit scope.

Customer trust

•Customer assurance. Oversees responses to security questionnaires, RFP security sections, due diligence requests and customer audits. Maintains a trust center and a standard documentation package that shortens sales cycles.

•Contract support. Advises Sales, Legal and Customer Success on security and compliance commitments in contracts, data processing agreements and SLAs.

Team leadership

•Team. Builds, leads and develops the GRC team, with coverage across the US and Noida sites so auditors, customers and internal teams in both time zones have a local point of contact.

•Tooling and automation. Owns GRC tooling and drives automated control monitoring and evidence collection.

•Budget. Owns GRC budget planning and vendor management.

•Awareness. Runs the security awareness and policy training program.

•Site relationship. If based in Noida, has a dotted line to the SVP Engineering & Head of India GCC for site matters, while reporting to the CPTO for all GRC work.

First-Year Priorities

•Complete the handover of Security Operations to Technology Operations, including tools, on-call duties and in-flight audit evidence, with no disruption to certifications.

•Publish a GRC charter, agreed with the CPTO, that sets out GRC's independence and decision rights alongside Technology Operations, Security Operations and the product trios.

•Deliver the next ISO 27001, SOC 1 and SOC 2 cycles on time with no significant exceptions.

•Stand up a single control framework and a current risk register with a named owner for every top risk.

•Agree vulnerability SLAs and key risk indicators with Technology Operations and report them to the CPTO each month.

•Confirm GRC coverage of the Noida site, including India obligations under the DPDP Act and CERT-In rules.

•Cut turnaround time for customer security reviews and launch a trust center.

•Set a baseline for the share of controls monitored automatically, and show measurable improvement against it.

Required Skills

•10+ years of experience in governance, risk and compliance, IT audit or information security, including 5+ years leading a team.

•A proven record of leading ISO 27001 and SOC 2 Type II programs in an enterprise SaaS company. Experience with SOC 1 and SOX IT general controls is a strong plus.

•Deep knowledge of control frameworks (NIST, ISO, SOC, CIS) and of global privacy regulation.

•Enough security operations knowledge to credibly test and challenge detection, response, vulnerability management and access controls.

•Experience building or scaling an enterprise risk program and presenting risk to executives and Boards.

•Experience running GRC across US and India delivery centers, including familiarity with the DPDP Act and CERT-In requirements.

•Strong influencing skills, including holding operational teams to account without direct authority over them.

•Experience with AI governance frameworks such as NIST AI RMF and ISO/IEC 42001 is a plus.

•Experience with B2B enterprise software, ideally in fintech, procure-to-pay, payments or data services, is a strong plus.

•Strong communication skills, including turning technical risk into business terms, and willingness to work across US Eastern and India business hours.

Education Levels/Credentials (Degree types and Emphasis)

•An undergraduate degree in information systems, computer science, accounting, business or a related field is required; equivalent professional experience will be considered. Certifications such as CISA, CRISC, CISSP, CISM, ISO 27001 Lead Auditor or Implementer, or CIPP/E are strongly preferred.

Physical/Remote/Travel Work Environment

•An apexanalytix office in the United States or the Global Capability Center in Noida, India, with hybrid working.

•Regular overlap with US Eastern business hours for executive, Board and audit commitments, and with India business hours for the Noida teams.

•Travel required: up to 20%, including travel between the US and Noida sites for audits and leadership meetings.

Over the years, we’ve discovered that the most effective and successful associates at apexanalytix are people who have a specific combination of values, skills, and behaviors that we call “The apex Way”. Read more about The apex Way - https://www.apexanalytix.com/careers/

Benefits

At apexanalytix we know that our associates are the reason behind our successes. We truly value you as an associate and part of our professional family. Our goal is to offer the very best benefits possible to you and your loved ones. When it comes to benefits, whether for yourself or your family the most important aspect is choice. And we get that. apexanalytix offers competitive benefits for the countries that we serve, in addition to our BeWell@apex initiative that encourages employees’ growth in six key wellness areas: Emotional, Physical, Community, Financial, Social, and Intelligence.

With resources such as a strong Mentor Program, Internal Training Portal, plus Education, Tuition, and Certification Assistance, we provide tools for our associates to grow and develop.