The Chief Information Security Officer (CISO) is responsible for defining, implementing, and governing the organization's enterprise-wide information security, cyber risk, and data protection strategy. The role ensures the confidentiality, integrity, and availability of information assets, while enabling secure digital transformation and regulatory compliance across banking and financial services operations. The CISO acts as a strategic advisor to the Board and senior management, aligning cybersecurity and data protection initiatives with business objectives, regulatory mandates (RBI, DPDP Act), and global best practices.

Roles & Responsibilities:

1. Strategy, Governance & Leadership

- Define and drive the Information Security and Cyber Risk Management strategy aligned with business and regulatory requirements.

- Establish and maintain the organization's Information Security Management Framework (ISMF), policies, standards, and procedures.

- Provide regular cyber risk posture reporting to the Board, Risk Management Committee, and senior leadership.

- Ensure alignment of information security strategy with enterprise risk management (ERM) framework.

2. Regulatory Compliance & Assurance

- Ensure compliance with RBI Cyber Security Framework, Master Directions on IT Governance, CERT-In guidelines, DPDP Act, and other applicable regulations.

- Lead and oversee internal audits, external audits, regulatory inspections, and compliance assessments.

- Act as the principal point of contact for regulators and auditors on cybersecurity and information security matters.

- Ensure timely closure of audit findings and regulatory observations.

3. Cyber Risk & Security Operations Oversight

- Oversee cyber risk assessments, threat modeling, vulnerability management, and penetration testing.

- Provide strategic oversight of Security Operations Center (SOC), incident detection, and response mechanisms.

- Lead the organization's cyber incident response and crisis management, including reporting, root cause analysis, and remediation.

- Ensure robust controls for endpoint security, network security, application security, cloud security, and identity & access management.

4. Data Protection & Privacy (DPDP Alignment)

- Oversee controls for data classification, data protection, encryption, retention, and secure disposal.

- Ensure privacy-by-design and security-by-design principles across systems and processes.

- Coordinate data breach response and regulatory notification as per DPDP Act requirements.

- Review and approve security architecture for new products, platforms, and vendor engagements.

- Ensure third-party and vendor risk management from a cybersecurity perspective.

5. People, Awareness & Capability Building

- Build and lead a high-performing information security and cyber risk team.

- Drive organization-wide cybersecurity awareness, training, and phishing simulation programs.

- Develop succession planning and skill enhancement for critical security roles.

Required Skills & Expertise:

1. Technical & Domain Skills

- Strong expertise in cybersecurity frameworks (ISO 27001, NIST, COBIT, CIS Controls).

- Deep understanding of banking technology, core banking systems, payment systems, digital channels, and cloud security.

- Hands-on knowledge of incident response, threat intelligence, SOC operations, and cyber forensics.

- Strong understanding of data protection and privacy regulations, including DPDP Act.

2. Leadership & Behavioral Skills

- Strategic thinking with strong risk-based decision-making capability.

- Ability to communicate complex security risks clearly to Board and senior leadership.

- High integrity, resilience, and crisis-management orientation.

- Strong stakeholder management and influencing skills.

Required Experience & Education:

1.Graduate (Preferably in engineering, Computer Science, Information Technology, or related field.

2. 12+ years of overall experience in IT / Cybersecurity, with recent few years in leadership role managing information security.

3. Prior experience in Banking / Financial Services / NBFC / Insurance would be plus.

4. Proven experience handling regulatory audits, cyber incidents, and board-level reporting.

About BGSS: Baroda Global Shared Services Ltd (BGSSL) is a wholly owned subsidiary of Bank of Baroda. Baroda Global Shared Services Ltd. is a state-of-the-art center located at the prime location of GIFT city, Gandhinagar. It has been setup to handle high volume of major back-office processes across the Bank. BGSS specializes in running the standardizing back-office processes and ensuring high volumes of operations are carried out in timely and accurate manner. The Specialized staff at BGSS has been trained on the global best practices and use the latest tools and technology to provide the best productivity levels with best-in-class Turnaround Time while also maintaining the highest standards of regulatory compliance. For more details, please visit: www.bgss.in