Lead - Governance, Risk & Compliance

ZS is a place where passion changes lives. As a management consulting and technology firm focused on improving life and how we live it, we transform ideas into impact by bringing together data, science, technology and human ingenuity to deliver better outcomes for all. Here you’ll work side-by-side with a powerful collective of thinkers and experts shaping life-changing solutions for patients, caregivers and consumers, worldwide. ZSers drive impact by bringing a client-first mentality to each and every engagement. We partner collaboratively with our clients to develop custom solutions and technology products that create value and deliver company results across critical areas of their business. Bring your curiosity for learning, bold ideas, courage and passion to drive life-changing impact to ZS.

Lead – Governance, Risk & Compliance

ZS is looking for a skilled and driven Lead– Governance, Risk & Compliance to join its Governance, Risk, and Compliance team. The consultant will serve as a hands-on Technology Risk Assessment subject-matter expert for applications, products, platforms, AI solutions, tools, cloud services, third-party technologies, and emerging technologies.

• Independently lead and deliver Application Security Governance, AI Risk Assessment, project-risk and material-change assessments for internal, client-facing, cloud-hosted, client-hosted, third-party and AI-enabled solutions.
• Determine assessment scope and applicable control requirements based on business criticality, data classification, external exposure, hosting model, technology stack, user population, regulatory and contractual obligations, AI usage, third-party dependencies and change magnitude.
• Develop a detailed understanding of product functionality, user journeys, architecture, data flows, trust boundaries, integrations, deployment models, administrative access and operational dependencies to identify credible risk scenarios.
• Assess solutions across ideation, architecture, design, development, testing, release, production operations, material change, migration and decommissioning.
• Participate in architecture reviews, design governance, stage gates, release-readiness reviews and production-readiness reviews, and provide documented risk recommendations.
• Evaluate inherent risk, control design and operating effectiveness, residual risk, compensating controls, remediation plans, exceptions and closure evidence using the approved risk methodology.
• Conduct review sessions with product owners, architects, engineers, developers, data scientists, security, privacy, legal, compliance, procurement and operations teams.
• Produce clear and defensible assessment reports documenting scope, assumptions, system context, evidence reviewed, risk scenarios, findings, ratings, residual risk, actions, dependencies and approval recommendations.
• Oversee high and critical remediation items, including accountable owners, target dates, interim safeguards, escalation, risk acceptance and closure validation.
• Support material incidents and risk escalations, identify root causes and recurring control weaknesses, and recommend program-level improvements.
• Develop management reporting covering assessment coverage, material findings, overdue actions, exceptions, recurring issues, trends and remediation performance.
• Contribute to policies, standards, procedures, control libraries, evidence standards, assessment playbooks, training, automation and continuous improvement.
• Secure SDLC and DevSecOps, including architecture review, threat modelling, SAST, DAST, API testing, software composition analysis, secrets management, penetration testing, CI/CD security, infrastructure as code and remediation validation.
• Modern architectures, including microservices, APIs, event-driven systems, containers, Kubernetes, serverless computing, SaaS, PaaS, IaaS, mobile, data and analytics platforms and low-code/no-code solutions.
• Identity and access management, encryption and key management, logging and monitoring, vulnerability management, environment segregation, third-party integrations, incident response, availability, backup, recovery, resilience and secure decommissioning.
• Technical evidence, including architecture and data-flow diagrams, API specifications, threat models, cloud configurations, pipelines, test reports, vulnerability reports, deployment workflows, operating records and control demonstrations.
• Assess AI and machine-learning solutions across data sourcing, model selection, training or fine-tuning, validation, hosting, access, integrations, third-party dependencies, deployment, monitoring, human oversight, suspension and retirement.
• Evaluate generative AI, foundation and open-source models, retrieval-augmented generation, agents, copilots, AI APIs, vector databases, plugins, tools and Model Context Protocol integrations.
• Assess risks including prompt injection, jailbreaks, insecure output handling, sensitive-data disclosure, model or data poisoning, hallucination, bias, toxicity, privacy leakage, excessive agency, weak tool permissions, supply-chain exposure, model theft and unsafe actions.
• Review data provenance, lawful use, consent, quality, representativeness, lineage, retention, intellectual property, training and inference-data protection, residency and cross-border requirements.
• Evaluate accuracy, robustness, explainability, benchmark selection, performance thresholds, validation independence, human approval, action limits, memory, identity propagation, kill switches, rollback and fail-safe behaviour.
• Define or review monitoring for model and data drift, anomalous behaviour, harmful outputs, performance degradation, incidents, complaints and regulatory or use-case changes.
• ISO/IEC 27001 and 27005, ISO 31000, NIST Cybersecurity Framework, NIST SP 800-53/30, NIST Secure Software Development Framework (SP 800-218), SOC 2, CIS Controls and Cloud Security Alliance guidance, including the Cloud Controls Matrix.
• OWASP Top 10, Application Security Verification Standard, API Security Top 10, Software Assurance Maturity Model, OWASP guidance for LLM applications.
• NIST AI Risk Management Framework, ISO/IEC 42001, ISO/IEC 23894, AIUC‑1, responsible AI principles and applicable AI regulatory expectations, including the EU AI Act where relevant.

What You'll Bring:
• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, Engineering, Information Systems or a related discipline.
• Minimum of 6+ years of professional experience in technology risk, Application security assessment, Cybersecurity assurance, security architecture, IT Audit, AI assessment & governance, DevSecOps governance — with significant experience at a Big 4, Big 3.
• Demonstrated track record of leading and executing technical security audits — hands-on experience conducting walkthroughs, reviewing evidence, and making independent control assessments
• Strong technical foundation across SDLC governance, CI/CD pipeline security, cloud security controls, access and identity management, application security, and secrets management
• Demonstrated experience independently scoping, conducting, documenting and concluding complex application or technology risk assessments.
• Experience reviewing the work of other assessors and challenging scope, evidence, control conclusions, findings, ratings, remediation and closure decisions.
• Ability to distinguish control design effectiveness from operating effectiveness and determine whether evidence is complete, current, relevant, reliable and sufficient.
• Strong analytical, facilitation, stakeholder-management, technical-writing and executive-communication skills, with the ability to exercise independent judgement and manage concurrent priorities.
• Mandatory certifications — CEH, ISO 27001 Lead auditor, ISO/IEC 42001 Lead Auditor.
• Fluency in English
• Client-first mentality
• Intense work ethic
• Collaborative spirit and problem-solving approach

How you’ll grow:
• Cross-functional skills development & custom learning pathways
• Milestone training programs aligned to career progression opportunities
• Internal mobility paths that empower growth via s-curves, individual contribution and role expansions

Perks & Benefits:

At ZS, your growth matters. We offer a comprehensive total rewards package that supports your health and well‑being, financial future, time away, and professional development. With robust skills‑building programs, multiple career progression paths, internal mobility, and a deeply collaborative culture, you’ll have the opportunity to do meaningful work, expand your capabilities, and thrive as part of a global community. For details on total rewards in India, visit ZS India office locations | Where we work | ZS.

Hybrid working model:

We are committed to giving our employees a flexible and connected way of working. A flexible and connected ZS allows us to combine work from home and on-site presence at clients/ZS offices for the majority of our week. The magic of ZS culture and innovation thrives in both planned and spontaneous face-to-face connections.

Travel:

Travel is a requirement at ZS for client facing ZSers; business needs of your project and client are the priority. While some projects may be local, all client-facing ZSers should be prepared to travel as needed. Travel provides opportunities to strengthen client relationships, gain diverse experiences, and enhance professional growth by working in different environments and cultures.

Considering applying?

At ZS, we honor the visible and invisible elements of our identities, personal experiences, and belief systems—the ones that comprise us as individuals, shape who we are, and make us unique. We believe your personal interests, identities, and desire to learn are integral to your success here. We are committed to building a team that reflects a broad variety of backgrounds, perspectives, and experiences. Learn more about our inclusion and belonging efforts and the networks ZS supports to assist our ZSers in cultivating community spaces and obtaining the resources they need to thrive.

If you’re eager to grow, contribute, and bring your unique self to our work, we encourage you to apply.

ZS is an equal opportunity employer and is committed to providing equal employment and advancement opportunities without regard to any class protected by applicable law.

To complete your application:
Candidates must possess or be able to obtain work authorization for their intended country of employment. An on-line application, including a full set of transcripts (official or unofficial), is required to be considered.

NO AGENCY CALLS, PLEASE.

Find Out More At:
www.zs.com