GRC and Vendor Risk Management

Who are we

Founded in 2014 by Khadim Batti and Vara Kumar Whatfix is a leading global B2B SaaS provider and the largest pure-play enterprise digital adoption platform (DAP). Whatfix empowers companies to maximize the ROI of their digital investments across the application lifecycle from ideation to training to the deployment of software. Driving user productivity ensuring process compliance and improving user experience of internal and customer-facing applications.

Spearheading the category with serial innovation and unmatched customer-centricity Whatfix is the only DAP innovating beyond the category positioning itself as a comprehensive suite for GenAI-powered digital adoption analytics and application simulation. Whatfix product suite consists of 3 products - DAP Product Analytics and Mirror. This product suite helps businesses accelerate ROI on digital investments by streamlining application deployment across its lifecycle.

Whatfix has seven offices across the US India UK Germany Singapore and Australia and a presence across 40 countries.

Customers: 700 enterprise customers including over 80 Fortune 500 companies such as Shell Microsoft Schneider Electric and UPS Supply Chain Solutions.

Investors: Raised a total of $270 million. Most recently Series E round of $125 Million led by Warburg Pincus with participation from existing investor SoftBank Vision Fund 2. Other investors include Cisco Investments Eight Roads Ventures (A division of Fidelity Investments) Dragoneer Investments Peak XV Partners and Stellaris Venture Partners.

• With over 45% YoY sustainable annual recurring revenue (ARR) growth Whatfix is among the Top 50 Indian Software Companies as per G2 Best Software Awards.

• Recognized as a Leader in the digital adoption platforms (DAP) category for the past 4 years by leading analyst firms like Gartner Forrester IDC and Everest Group.

• The only vendor recognized as a Customers Choice in the 2024 Gartner Voice of the Customer for Digital Adoption Platforms has once again earned the Customers Choice distinction in 2025. We also boast a star rating of 4.6 on G2 Crowd 4.5 on Gartner Peer Insights and a high CSAT of 99.8%

• Highest-Ranking DAP on 2023 Deloitte Technology Fast 500 North America for Fourth Consecutive Year

• Won the Silver for Stevies Employer of the Year 2023 Computer Software category and also recognized as Great Place to Work 2022-2023

• Only DAP to be among the top 35% companies worldwide in sustainability excellence with EcoVadis Bronze Medal

On the G2 peer review platform Whatfix has received 77 Leader badges across all market segments including Small Medium and Enterprise in 2024 among numerous other industry recognitions.

Role Summary:

We are looking for an Information Security GRC Engineer to support and drive Whatfixs multi-framework compliance program across Information Security Data Privacy AI Governance and Third-Party Risk Management (TPRM).

A key responsibility of this role will be to manage and operate the organizations end-to-end TPRM program including vendor onboarding risk assessments due diligence periodic reassessments risk tracking remediation offboarding and continuous improvement of the TPRM framework.

Roles & Resposblities:

Over all 3 years of expereince in Third Party Risk Management

• Manage and operate the end-to-end Third-Party Risk Management (TPRM) program including vendor onboarding risk classification due diligence security and privacy assessments periodic reassessments remediation tracking and offboarding.

• Conduct and coordinate third-party information security privacy compliance and AI risk assessments.

• Review vendor-provided evidence and artefacts including security questionnaires certifications audit reports policies and other assurance documentation.

• Identify assess document and track risks associated with third-party relationships and follow up on mitigation and remediation actions.

• Maintain accurate vendor inventories assessment records risk ratings findings exceptions and reassessment schedules.

• Manage and continuously monitor the vendor/TPRM management platform and related trackers to ensure records remain complete and up to date.

• Coordinate with internal stakeholders and vendors throughout the third-party lifecycle.

• Maintain and continuously improve TPRM policies procedures SOPs risk assessment methodologies and reporting.

GRC Compliance & AI Governance

• Support the implementation maintenance and continual improvement of compliance programs including (but not limited to) ISO 27001 ISO 27701 ISO 42001 CSA STAR TISAX Cyber Essentials Plus GDPR DPDP HIPAA and other applicable requirements.

• Manage day-to-day compliance activities including GRC platforms evidence collection compliance trackers stakeholder follow-ups and SOPs.

• Support internal and external audits including audit preparation evidence management stakeholder coordination and tracking observations and corrective actions.

• Assist in conducting information security privacy compliance and AI risk and impact assessments.

• Support the organizations AI governance program including maintaining the AI inventory and supporting AI risk assessments and governance activities.

• Support periodic review and maintenance of Information Security Privacy AI and other GRC-related policies and procedures.

• Assist with security privacy and AI awareness initiatives.

• Monitor relevant regulatory security privacy and AI developments and support continuous improvement of GRC processes.

• Manage and coordinate customer due-diligence requests including security privacy compliance and AI questionnaires evidence requests and stakeholder coordination.

• Review information security data privacy and AI-related contractual requirements in customer and vendor agreements including DPAs security addendum and other contractual obligations.

• Strong understanding of Third-Party Risk Management including vendor lifecycle management due diligence risk assessments evidence review risk rating remediation and periodic reassessments.

• Working knowledge of Information Security GRC risk management audits and compliance management.

• Familiarity with relevant standards and regulations including ISO 27001 ISO 27701 ISO 42001 CSA STAR TISAX Cyber Essentials Plus GDPR DPDP and HIPAA.

• Understanding of AI governance responsible AI and AI risk/impact assessments.

• Strong analytical documentation stakeholder management communication and follow-up skills.

• Ability to manage multiple vendors stakeholders compliance activities and deadlines with strong attention to detail.