Chief Information Security Officer

NABFINS LTD; Bengaluru; On-site; INR 6,000,000 - 12,000,000; Full time

Job summary

NABFINS Ltd in Bengaluru seeks a senior CISO to lead enterprise-wide information security strategy, IT risk management, and governance across RBI, IRDAI, and DPDP frameworks.

The role requires 5+ years in IT/Security with at least 2 in leadership; certifications such as CISA, CISSP, CISM or CEH. You will brief the Board, coordinate audits, and strengthen cyber resilience across the organization.

Qualifications

• Minimum 5+ years of experience in IT/ Information Security, with at least 2 years in a senior leadership role (CISO / Deputy CISO / Head of Information Security).
• Experience with IT Governance, Risk & Compliance, DPDP Act, RBI/IRDAI guidelines, CERT-In, and security audits.

Responsibilities

• Review the information and Cyber security posture of the company.
• Identify gaps in Cyber security and elevate the same to DIT.
• Present agendas on Cyber security related aspects to the Board/Committees of the Board.
• Conduct enterprise-wide cyber risk assessment for NABFINS across branches, HO, applications in use, etc.
• Classification of risks identified and extending support to the Internal IT Team to ensure remediation of gaps.
• Coordinating for conduct of Information Security Committee (ISC) meetings.
• Conduct cyber security awareness trainings to employees.
• Coordinating cyber resilience activities across the organization.
• Incident Management - Lead strategic response to information security incidents and provide post-event analyses.
• Preparation of detailed RCA
• Drafting responses to regulators
• Regular and adhoc reporting through regulatory portals
• Coordinate IS Audit, VAPT, etc.
• Devise frameworks for IS Audits and VAPT
• Coordinate with DIT for resolution of issues identified during IS Audit/VAPT
• Draft compliance to VAPT, IS Audit observations
• Annual review of IT Policies for adequacy
• Ensure compliance to RBI/IRDAI IT guidelines.
• Define Key Risk Indicators (KRI) for monitoring cyber security resilience
• Collaborate with CTO/CIO on disaster recovery plans
• Negotiate contracts for security products/services
• Identify emerging tech trends for security controls
• Explore tools for cyber resilience and report relevance to Management
• Revision of IT/IS policies presented to Board and ITSCB.

Skills

Information Security Risk Management

Third-Party Risk

Identity and Access Management

Zero Trust Architecture

DevSecOps

Data Protection & Resilience

Incident detection and Response

SIEM and SOC operations

Data Security

API Security

Education

Graduation in Engineering/Computer Science/Information Technology

Job description

Chief Information Security Officer (CISO) - AGM is responsible for overseeing the overall information security strategy of the organization and is entrusted with the responsibility of developing, implementing and monitoring a strategic and comprehensive enterprise-wide information security and IT risk management.

Mandatory:

Minimum 5+ years of experience in IT/ Information Security, with at least 2 years in a senior leadership role (CISO / Deputy CISO / Head of Information Security).

Knowledge & Competence Areas:

• The candidate should demonstrate expertise and leadership-level understanding of IT Governance, Risk & Compliance:
• IT Act, Digital Personal Data Protection (DPDP) Act and associated rules thereunder, IRDAI and other Regulatory Guidelines, CERT-In cyber security circulars and RBI guidelines.

Regulatory and Compliance Responsibilities:

• Coordinate with regulatory and intelligence agencies including RBI, NABARD, IRDAI, and CERT-In CSITE for information sharing and compliance.
• Coordination with departments in NABFINS for the regulatory compliance.
• Ensure compliance with the IT Act, Digital Personal Data Protection (DPDP) Act, IRDAI Cybersecurity Guidelines, and other domestic and international standards.
• Liaise with the Company’s Legal and Compliance teams to interpret regulatory updates and ensure timely security control alignment.
• Lead the development and maintenance of the organizational Data Governance framework, policies, and standards related to data classification, retention, and access controls.
• Oversee the resolution of audit observations and inspection findings from regulators, statutory auditors, and internal/external agencies.
• Coordination with the internal/external auditors aligned for IT audits such as Information Security audit, Vulnerability assessment and penetration test, Insurance Regulatory and Development Authority of India audit, RBI audit, and NABARD audit

Advisory and Reporting Responsibilities:

• Oversee the design and delivery of information security awareness and training programs for employees, vendors, and senior management, ensuring relevance, effectiveness, and compliance with regulatory requirements.
• Regularly brief top management, Risk Management Committee and the Board Risk/IT Committee on cyber security posture, risks, compliance, and initiatives.
• Preparation of agendas and presentation to the Board / IT committee.
• Oversee the development and ensure presentation of executive dashboards and key metrics on risk, compliance, incident management, and overall security posture to senior management, Board and ITSCB.
• Represent the Company in industry forums, regulatory committees, and technical conferences on information and cyber security.
• Advise leadership on emerging global threats, vulnerabilities, and recommended actions to strengthen the Company’s resilience.
• Ensure transparent communication with stakeholders (internal and external) during cyber incidents as per crisis communication protocols.

Candidate must be well versed in:

• Information Security Risk Management
• Third-Party Risk, Supply Chain Security
• Cyber Insurance
• SIEM and SOC operations
• Incident detection and Response (EDR)
• Identity and Access Management (IAM)
• Privilege access management (PAM)
• Network Access Control (NAC)
• Zero Trust Architecture (ZTA)
• Secure Software Development Life Cycle (SDLC)
• Development, Security, and Operations (DevSecOps)
• API Security
• Data Protection & Resilience
• Data Security
• Security Testing
• DR & BCP
• Crisis Management
• Emerging Security Practices
• AI/ML in threat detection
• Security Automation
• Advanced Threat Hunting.

CISO – Roles and responsibilities

• Review the information and Cyber security posture of the company
• Identify the gaps in Cyber security and elevate the same to DIT
• Present agendas on Cyber security related aspects to the Board/Committees of the Board
• Conduct enterprise-wide cyber risk assessment for NABFINS across branches, HO, applications in use, etc.
• Classification of risks identified and extending support to the Internal IT Team to ensure that the identified security control gaps are understood and duly remediated
• Coordinating for conduct of Information Security Committee (ISC) meetings
• Conduct cyber security awareness trainings to employees
• Coordinating the conduct cyber resilience activities across the organization
• Incident Management - Lead strategic response to information security incidents and provide post-event analyses
• Preparation of detailed RCA
• Drafting the response to queries raised by Regulators
• Regular and adhoc reporting through regulatory portals
• Coordinate the conduct of IS Audit, VAPT etc.
• Devise Frameworks for IS Audits and VAPT
• Coordinate with DIT for resolution of the issues identified during IS Audit/VAPT
• Draft the compliance to VAPT, IS Audit observations
• Annual review of all IT Policies for their adequacy and identify implementation gaps, if any
• Ensure compliance to internal policies as well as Legal and Regulatory Guidelines (RBI, IRDAI) pertaining to IT
• Define Key Risk Indicators (KRI) for monitoring cyber security resilience
• Collaborate with CTO/CIO to create and implement enterprise-wide disaster recovery plans
• Negotiate contracts with vendors and service providers for installing security products and services
• Recognize the emerging technology trends and ensure cybersecurity controls are implemented to secure the ever-changing landscape
• Explore latest tools for cyber resilience and inform the Management of their relevance, feasibility etc.
• Revision of policies related to Information Technology (IT) and Information Security (IS) and presentation to Board and ITSCB.

Qualifications

• Should be qualified with at least two of the following certifications
• CISA (Certified Information Systems Auditor)
• CISSP (Certified Information Systems Security Professional)
• CISM (Certified Information Security Manager)
• CEH (Certified Ethical Hacker)
• Proven experience as a CISO or similar role in information security management and cybersecurity for at least 2 years
• OR
• Experience in working on Information Security or Cyber Security domains for at least 5 years
• Graduation – Preferably: Degree in Engineering, Computer Science/Information Technology or its equivalent.
• Experience and Knowledge of Security best practices across IT domains (Infrastructure, Application, Enterprise architecture etc.)
• Robust experience of designing and deploying security solutions
• Good knowledge of the IT Regulatory Framework which NABFINS is bound to follow.
• Should have experience in Cyber Incidence Response and Co-ordination.