Dynamics of the Role:

We are seeking an experienced Information Security professional to lead the Security Architect and the Infosec GRC teams. The role will be responsible to design, implement, and manage the security frameworks that protect our organization's systems, networks, and data. This role will also be responsible for assessing the design and performance of the key controls and works with senior stakeholders to implement corrective actions. Primary focus will be to ensure that security policies and controls are designed and implemented to align with regulatory requirements, business objectives and industry standards.

Key Responsibilities:

Security Architect:

1. Security Design and Architecture:

- Develop and maintain comprehensive security architectures aligned with industry standards (PCI-DSS, NIST, ISO 27001).

- Design secure systems, networks, and applications across on-premises and cloud environments.

- Ensure security integration into all stages of the software development lifecycle (SDLC)

2. Risk Management and Compliance:

- Conduct risk assessments and vulnerability analysis to identify and mitigate threats.

- Ensure compliance with applicable regulations, such as RBI, CICRA, PCI-DSS, SOC2, SOX.

- Implement security controls and governance processes to meet organizational requirements

3. Security Assurances:

- Ensure comprehensive implementation of security preventative and detective measures on Perimeter, Endpoint solutions and SIEM solutions.

- Provide expertise in encryption, authentication, and identity management systems

4. Leadership and Collaboration:

- Collaborate with stakeholders to define security requirements for new projects.

- Act as a trusted advisor to executive leadership on security-related matters.

- Lead cross-functional teams to address security challenges and promote best practices

5. Continuous Improvement:

- Stay updated with emerging cybersecurity threats, trends, and technologies.

- Develop and deliver security training programs to enhance awareness across the organization.

- Conduct regular reviews and audits of security systems and policies.

Governance, Risk and Compliance (GRC)

1. Information Security Risk Assessment and Governance

- Develop and maintain the organization's security governance framework, including policies, procedures, and standards that align with industry best practices (e.g., ISO 27001, NIST).

- Drive and collaborate on certification compliance on key industry frameworks such as ISO 27001, PCI-DSS, SOC1 and SOC2.

- Ensure consistent implementation and enforcement of security policies across the organization, driving compliance with internal and external security standards.

- Review new product initiatives and provide feedback

- Lead the development of a comprehensive risk management program to identify, assess, and manage cybersecurity risks across the enterprise.

- Collaborate with key stakeholders to ensure that risk assessments are conducted regularly and that mitigation strategies are in place for high-priority risks.

- Review product centric legal documentation on security aspects required for vendors/partners/Third parties to adhere to.

- Provide assurance to B2B Members

- Conduct RCSA and control testing for Infosec unit on periodic basis

- Perform security assessments and due diligence for third-party vendors, ensuring contractual obligations and security requirements are met.

- Manage security exceptions and ensure thorough risk assessment.

2. Regulatory and Compliance

- Stay informed about evolving regulatory advisories and compliance requirements.

- Lead internal and external audit processes related to security, ensuring that findings are addressed promptly and effectively.

- Maintain internal activity calendar for assurance.

- Regularly review and monitor third-party risks, ensuring ongoing compliance with security policies and regulatory standards.

- Drive organization wide security awareness programs, content creation and phishing simulation.

- Manage RBI inspections (Department of Supervision, CSITE) and Regulatory submissions for infosec requirements along with compliance team, Internal and Group level stakeholders.

- Align on infosec KRIs data submissions and alignment with various risk and compliance units.

- Regulatory queries and ad-hoc submissions through DAKSH and email.

- Assist in preparation for Infosec council, Board presentations and track actionable.

- Act as an SME on infosec regulatory matters for guidance/ clarifications to various functions.

Required Qualifications:

- Bachelor's or Master's degree in Computer Science, Cybersecurity, or a related field

- Minimum 15 years of experience in Information Security Domain with atleast 8-10 years in GRC and Architect functions

- Strong knowledge of security frameworks and standards (e.g., NIST, TOGAF, SABSA)

- In-depth knowledge of security frameworks (e.g., ISO 27001, NIST, CIS Controls), risk management principles, and compliance regulations.

- Relevant certifications such as CISA, CRISC, CISSP, or ISO 27001, PCIDSS are highly desirable.

- Strong understanding of risk management methodologies, governance structures, and regulatory compliance requirements.

- Proficiency in cloud security (AWS, Azure, GCP) and hybrid environments.

- Hands-on experience with security technologies such as firewalls, endpoint protection, IAM, and SIEM tools.

- In-depth understanding of cryptographic principles, network security, and secure application design.

- Knowledge on DevSecOps practices

- Good to have exposure and fundamental clarity on Cloud security

- Exceptional communication and presentation skills, with the ability to engage and influence senior executives and board members.

Preferred Certifications:

- Certified Information Systems Security Professional (CISSP)

- Certified Information Security Manager (CISM)

- Certified Cloud Security Professional (CCSP)

Key Skills:

- Strategic thinking and problem-solving abilities.

- Excellent communication and interpersonal skills.

- Strong leadership and project management expertise.

- Ability to work under pressure and manage complex projects.