Information Security Officer

Role Summary:

We are seeking an experienced Information Security professional to support the Governance, Risk, Compliance (GRC), Vulnerability Management, and Security Assurance functions at BillDesk. The ideal candidate will be responsible for developing robust security policies and procedures, conducting risk assessments, managing end-to-end security audits, tracking vulnerabilities, performing infrastructure security gap assessments, and ensuring strict compliance with ISO 27001, PCI DSS, RBI guidelines, and various customer security requirements.

Key Responsibilities:

1. Governance & Compliance:

- Develop, implement, and maintain Information Security Policies, Standards, Procedures, and Guidelines.

- Support, optimize, and enhance the overall Information Security Management System (ISMS).

- Ensure absolute compliance with ISO 27001, PCI DSS, RBI regulations, and internal security requirements.

- Act as the primary coordinator for internal, external, customer, banking partner, and regulatory audits.

2. Risk Management & Security Assessments:

- Conduct comprehensive Information Security Risk Assessments for applications, core infrastructure, cloud, and third-party environments.

- Perform detailed infrastructure and security control gap assessments against regulatory and industry benchmarks.

- Own and maintain the organization's risk registers while rigorously tracking remediation activities.

3. Vulnerability Management:

- Review Vulnerability Assessment and Penetration Testing (VAPT) reports and oversee systematic vulnerability remediation activities.

- Track the closure of vulnerabilities identified through scans, penetration tests, audits, and routine assessments.

- Monitor patch management compliance and ensure strict adherence to security remediation timelines.

- Prepare actionable vulnerability dashboards and high-level management reports.

4. Third-Party Security & Audit Management:

- Conduct rigorous vendor and third-party security risk assessments.

- Review third-party security certifications, audit reports, and compliance evidence.

- Manage audit observations and drive the timely, verified closure of findings.

5. Reporting & Governance:

- Prepare security governance dashboards, audit reports, key risk metrics, and compliance status reports.

- Present the current security posture and compliance updates clearly to management and key stakeholders.