Role Overview:

The Chief Information Security Officer (CISO) is responsible for establishing, implementing, operating, monitoring, and continuously enhancing OneFin's Information Security Management System (ISMS) across all product lines and enterprise infrastructure. This leader will own end-to-end information security strategy, cloud security governance (AWS), regulatory compliance (RBI guidelines for digital lending and IT governance), ISO/IEC 27001:2022 standards, and client-facing security assessments for institutional banking partners. Implement zero trust security architecture.

Key Responsibilities:

1. Information Security Governance & Strategy:

- Define, maintain, and enforce OneFin's Level-1 ISMS policies, standards, and guidelines in alignment with business goals.

- Report security posture, risk profiles, and incident metrics directly to the CEO, C-suite, and Board of Directors.

- Lead the annual risk assessment framework across all business units, maintaining the enterprise Risk Register and tracking remediation strategies.

- Establish annual security objectives, measurable parameters, and operational security targets.

2. Regulatory, Compliance & Client Audit Management:

- Direct compliance for ISO/IEC 27001:2022 certifications, surveillance audits, and internal security audits.

- Ensure strict adherence to Reserve Bank of India (RBI) guidelines regarding digital lending, data localization, outsourcing, and cloud management.

- Act as the executive point of contact for financial institution (FI) client audits, managing Information Security Group (ISG) checklists, VAPT review points, and security questionnaires.

- Oversee Data Protection and Privacy compliance, protecting Personally Identifiable Information (PII) and Sensitive Personal Data or Information (SPDI).

- Oversee source code audits, and conduct internal security audits of codebase.

3. Cloud Infrastructure & Product Security:

- Oversee security configuration across AWS environments, ensuring AES-256 encryption at rest (S3, RDS, ECR) and enforced TLS/HTTPS in transit.

- Enforce secure architecture models for single-tenant / dedicated client deployments on Financial Institution AWS infrastructure.

- Direct Web Application Firewall (WAF) policies, IP/URL whitelisting, geo-blocking, and network perimeter controls.

- Maintain DevSecOps rigor within CI/CD pipelines (GitHub Actions), ensuring automated peer reviews, static analysis, code coverage thresholds, and container image vulnerability management.

4. Threat Management & Security Operations (SecOps):

- Lead the Incident Response Team; ensure end-to-end management, SLA tracking, and Root Cause Analysis (RCA) for all P1/Critical incidents.

- Oversee centralized logging, Database Activity Monitoring (DAM), and integration capabilities with Bank SIEM systems.

- Mandate periodic Vulnerability Assessment & Penetration Testing (VAPT) across applications, APIs, and cloud infrastructure.

- Enforce robust Access Control & Identity Management (IAM), including mandatory multi-factor authentication (MFA) across email, code repositories, and cloud portals.

5. Third-Party Risk & Business Continuity:

- Enforce Third-Party Risk Management (TPRM) guidelines, ensuring mandatory MSAs and NDAs across all vendors.

- Manage annual Business Continuity Planning (BCP) and Disaster Recovery (DR) drills, validating Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO).

- Conduct annual enterprise-wide security awareness training programs and specialized DevSecOps workshops.

Candidate Qualifications:

- Education: Bachelor's or Master's degree in Computer Science, Information Technology, Cybersecurity, or related engineering fields.

- Experience: 12+ years in Information Security and Technology Risk, with at least 4+ years in a leadership role (CISO, Head of Security, or Director of InfoSec).

- Domain Background: Prior experience in Fintech, B2B SaaS, Banking, or Financial Services ecosystems is strictly required.

Certifications (Preferred):

- Certified Information Systems Security Professional (CISSP)

- Certified Information Security Manager (CISM)

- Certified Information Systems Auditor (CISA)

- ISO/IEC 27001 Lead Auditor / Lead Implementer

Technical & Professional Competencies:

- Cloud Security: Deep expertise in AWS Security Hub, WAF, KMS, CloudTrail, IAM, RDS/S3 encryption, and containerized deployments (ECS/ECR).

- Frameworks: Hands-on mastery of ISO/IEC 27001:2022, NIST CSF, OWASP Top 10, and SOC 2 Type II compliance.

- Regulatory Knowledge: In-depth knowledge of RBI Cybersecurity Framework, RBI Digital Lending Directions, and Indian Data Protection laws.

- Application Security: Expertise in DevSecOps, API security, automated code scanners, tesseract/OCR pipeline security, and LLM/AI model deployment governance.

- Leadership: Exceptional stakeholder management, board-level reporting, and experience negotiating security requirements with Tier-1 Bank CISOs.