Head - GRC

At apexanalytix, we’re lifelong innovators! Since the date of our founding nearly four decades ago we’ve been consistently growing, profitable, and delivering the best procure-to-pay solutions to the world.   We’re the perfect balance of established company and start-up.  You will find a unique home here. 

apexanalytix is seeking an experienced governance, risk and compliance leader to serve as Head of GRC, based in the United States or in Noida, India. The role reports to the Chief Product & Technology Officer (CPTO), who leads apexanalytix's global engineering, product and hosted IT organizations. As a member of the CPTO's leadership team, the Head of GRC owns the company's control framework, its ISO 27001, SOC 1 and SOC 2 programs, and its enterprise and third-party risk management, and gives independent assurance that the controls run across the organization work as intended.

The role is deliberately independent of the controls it tests. Security Operations, the datacenter, production environments and corporate IT sit with the VP Technology Operations. Product identity and security tooling in the delivery pipeline sit with the Platform team. GRC sets the standards these teams work to, tests whether their controls work, and reports the results directly to the CPTO.

Today the GRC team also runs security operations. Under the new organization design, Security Operations moves to Technology Operations. The Head of GRC leads that handover and then builds GRC into a focused, independent assurance function.

•        Advises the CPTO, the executive team and, as needed, the Board or Audit Committee on the company's risk position, compliance obligations and the state of its controls.

•        Gives product and engineering leaders an early, clear view of the compliance and risk impact of new products, AI capabilities, architecture changes and acquisitions.

•        Acts as the senior voice of security and compliance assurance toward enterprise customers, auditors and regulators.

•        Works with Legal, Privacy and Finance to turn regulatory and contractual obligations into practical control requirements.

•        Complete the handover of Security Operations to Technology Operations, including tools, on-call duties and in-flight audit evidence, with no disruption to certifications.

•        Publish a GRC charter, agreed with the CPTO, that sets out GRC's independence and decision rights alongside Technology Operations, Security Operations and the product trios.

•        Deliver the next ISO 27001, SOC 1 and SOC 2 cycles on time with no significant exceptions.

•        Stand up a single control framework and a current risk register with a named owner for every top risk.

•        Agree vulnerability SLAs and key risk indicators with Technology Operations and report them to the CPTO each month.

•        Confirm GRC coverage of the Noida site, including India obligations under the DPDP Act and CERT-In rules.

•        Cut turnaround time for customer security reviews and launch a trust center.

•        Set a baseline for the share of controls monitored automatically, and show measurable improvement against it.

•        10+ years of experience in governance, risk and compliance, IT audit or information security, including 5+ years leading a team.

•        A proven record of leading ISO 27001 and SOC 2 Type II programs in an enterprise SaaS company. Experience with SOC 1 and SOX IT general controls is a strong plus.

•        Deep knowledge of control frameworks (NIST, ISO, SOC, CIS) and of global privacy regulation.

•        Enough security operations knowledge to credibly test and challenge detection, response, vulnerability management and access controls.

•        Experience building or scaling an enterprise risk program and presenting risk to executives and Boards.

•        Experience running GRC across US and India delivery centers, including familiarity with the DPDP Act and CERT-In requirements.

•        Strong influencing skills, including holding operational teams to account without direct authority over them.

•        Experience with AI governance frameworks such as NIST AI RMF and ISO/IEC 42001 is a plus.

•        Experience with B2B enterprise software, ideally in fintech, procure-to-pay, payments or data services, is a strong plus.

•        Strong communication skills, including turning technical risk into business terms, and willingness to work across US Eastern and India business hours.

•        An undergraduate degree in information systems, computer science, accounting, business or a related field is required; equivalent professional experience will be considered. Certifications such as CISA, CRISC, CISSP, CISM, ISO 27001 Lead Auditor or Implementer, or CIPP/E are strongly preferred.

•        An apexanalytix office in the United States or the Global Capability Center in Noida, India, with hybrid working.

•        Regular overlap with US Eastern business hours for executive, Board and audit commitments, and with India business hours for the Noida teams.

•        Travel required: up to 20%, including travel between the US and Noida sites for audits and leadership meetings.