Chief Information Security Officer

Apcfss; Guntur District; On-site; INR 3,500,000 - 7,000,000; Full time

Job summary

APCFSS seeks a senior cybersecurity leader to drive strategy, governance, risk management, and incident response for government IT systems. The role leads SOC operations, vulnerability management, and third‑party security reviews to safeguard critical applications and data.

The ideal candidate will have extensive experience in public-sector cybersecurity, strong governance skills, and certifications such as CISSP or ISO 27001 Lead Auditor.

Qualifications

• Bachelor's or master's degree in computer science, IT, cybersecurity, information security or related discipline.
• Postgraduate qualification in cybersecurity or information security is advantageous.
• Certifications such as CISSP, CISM, CISA, CRISC, CEH, ISO 27001 Lead Auditor/Lead Implementer preferred.

Responsibilities

• Develop and implement enterprise cybersecurity strategies and governance frameworks.
• Lead Security Operations Centre, SIEM, threat monitoring and incident response.
• Oversee risk assessments, audits, VAPT, and third‑party security reviews.
• Ensure compliance with government policies, ISO 27001, NIST, CERT-In directives, and data protection laws.
• Coordinate with government departments, auditors, and vendors to strengthen security posture.

Skills

Cybersecurity Governance

Risk Management

App & Infra Security

Enterprise Security

Security Operations

Data Protection

Regulatory Compliance

BCP/DRP

Education

Bachelor's or master's degree in computer science or cybersecurity

Postgraduate qualification in Cybersecurity/Information Security/Management

Professional certifications such as CISSP, CISM, CISA, CRISC, CEH, ISO 27001 Lead Auditor/Lead Implementer

Tools

OWASP

SIEM

ERP/Database Security

Job description

Key Roles & Responsibilities

Cybersecurity Strategy & Governance

• Develop and implement comprehensive information security and cybersecurity strategies for APCFSS.
• Establish security policies, standards, guidelines, procedures, and governance frameworks.
• Align cybersecurity initiatives with Government of Andhra Pradesh IT policies and organizational objectives.
• Advise senior management on cybersecurity risks, security priorities, and mitigation strategies.
• Establish security controls to protect mission-critical government applications and information systems.

Information Security Risk Management

• Identify, assess, prioritize, and manage cybersecurity risks across enterprise applications, infrastructure, networks, and databases.
• Conduct periodic Information Security Risk Assessments (ISRA), security audits, and vulnerability assessments.
• Oversee Vulnerability Assessment and Penetration Testing (VAPT) activities.
• Develop risk mitigation and remediation plans and monitor their implementation.
• Evaluate security risks associated with third-party vendors, system integrators, cloud service providers, and technology partners.

Application & Infrastructure Security

• Ensure security of critical government applications, including CFMS and other e-Governance platforms.
• Oversee security architecture for web applications, mobile applications, APIs, databases, and enterprise systems.
• Implement secure application development practices and conduct periodic application security reviews.
• Establish access management, authentication, encryption, and database security mechanisms.
• Ensure security controls are incorporated throughout the Software Development Life Cycle (SDLC).

Cybersecurity Operations & Incident Management

• Establish and oversee Security Operations Centre (SOC) functions and security monitoring mechanisms.
• Implement SIEM, intrusion detection, endpoint protection, and threat monitoring solutions.
• Develop and maintain cybersecurity incident response plans and escalation procedures.
• Lead responses to cyberattacks, data breaches, unauthorized access, and other security incidents.
• Coordinate with relevant government cybersecurity agencies and CERT-In, as required.
• Conduct post-incident investigations and implement corrective and preventive measures.

Regulatory Compliance & Security Audits

• Ensure compliance with applicable Government of India and Government of Andhra Pradesh cybersecurity policies, guidelines, and regulatory requirements.
• Implement relevant security standards such as ISO 27001 and the NIST Cybersecurity Framework.
• Ensure compliance with applicable CERT-In directions, IT Act requirements, and data protection regulations.
• Coordinate internal and external security audits, regulatory inspections, and compliance assessments.
• Lead responses to audit observations and regulatory requests.
• Maintain security documentation, compliance reports, and audit records.

Data Security & Privacy Management

• Establish data protection and privacy policies for government financial and administrative information.
• Ensure confidentiality, integrity, and availability of critical government data.
• Implement data classification, encryption, backup, access control, and Data Loss Prevention (DLP) mechanisms.
• Protect sensitive financial transactions, employee information, beneficiary data, and departmental records.
• Ensure secure data exchange and integration between government departments and external systems.
• Monitor and prevent unauthorized data access, disclosure, and misuse.

Business Continuity & Disaster Recovery

• Develop and implement Business Continuity Plans (BCP) and Disaster Recovery Plans (DRP).
• Establish disaster recovery strategies for critical applications, databases, and infrastructure.
• Ensure regular backup, restoration, and disaster recovery testing.
• Define Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) for critical systems.
• Ensure continuity of essential government financial and e-Governance services during disruptions.

Vendor & Third-Party Security Management

• Evaluate and manage cybersecurity risks associated with technology vendors, system integrators, cloud service providers, data centres, and outsourced service providers.
• Establish and enforce third-party security policies, guidelines, and cybersecurity requirements in vendor contracts, MoUs, and Service-Level Agreements (SLAs).
• Conduct periodic third-party security assessments, audits, and compliance reviews, including evaluation of vendor security architecture, infrastructure, and data protection practices before onboarding.
• Monitor and control vendor access to organizational systems, applications, databases, and sensitive information, ensuring appropriate security controls throughout outsourced IT operations.
• Ensure timely reporting of security incidents, data breaches, and vulnerabilities by vendors, and periodically review their business continuity and disaster recovery arrangements to ensure uninterrupted services.

Cybersecurity Awareness & Training

• Develop and implement cybersecurity awareness programs for APCFSS employees and project teams.
• Conduct periodic training on phishing, data protection, password security, and safe IT practices.
• Promote cybersecurity awareness among government department users of APCFSS-managed applications.
• Conduct security drills and awareness campaigns to improve organizational preparedness.

Team Leadership & Stakeholder Management

• Lead and manage information security and cybersecurity teams.
• Coordinate with IT infrastructure, application development, database, SAP, and project management teams.
• Work closely with government departments, regulatory authorities, security auditors, and technology partners.
• Present cybersecurity status, risks, incidents, and compliance reports to senior management.
• Provide strategic recommendations for improving APCFSS's overall information security posture.

Educational Qualifications

• Bachelor's or masters degree in computer science, Information Technology, Cybersecurity, Information Security, or a related discipline.
• Postgraduate qualification in Cybersecurity, Information Security, or Management is an added advantage.
• Professional certifications such as CISSP, CISM, CISA, CRISC, CEH, ISO 27001 Lead Auditor, or Lead Implementer are preferred.

Required Experience

• 1520+ years of overall experience in IT, Information Security, or Cybersecurity.
• Minimum 58 years of experience in senior cybersecurity leadership positions.
• Proven experience in developing and implementing enterprise-wide cybersecurity strategies.
• Experience managing large-scale government IT systems, financial applications, ERP platforms, or e-Governance projects.
• Strong experience in cybersecurity governance, risk management, VAPT, security audits, and incident management.
• Experience coordinating with government departments, regulatory authorities, auditors, and third-party technology vendors.
• Experience in public-sector, BFSI, government technology, or large enterprise environments will be preferred.

Technical Skills & Expertise

• Cybersecurity Governance: ISO 27001, NIST & Security Policies.
• Risk Management: ISRA, VAPT & Risk Mitigation.
• Application & Infrastructure Security: OWASP, Secure SDLC, API, Network, Server & Endpoint Security.
• Enterprise Security: SAP, ERP & Database Security.
• Security Operations: SOC, SIEM & Threat Monitoring.
• Data Protection & Incident Management: Encryption, DLP, Access Controls, Incident Response & Forensics.
• Regulatory Compliance: CERT-In, IT Act & Government Guidelines.
• Business Continuity & Vendor Management: BCP, DRP, RTO, RPO & Third-Party Risk Assessment.

Key Performance Indicators (KPIs)

• Strengthening of APCFSS's overall cybersecurity and information security framework.
• Security compliance of critical government applications and IT infrastructure.
• Timely identification and resolution of security vulnerabilities.
• Reduction in cybersecurity incidents and data security risks.
• Successful completion of information security audits.
• Effective implementation and testing of disaster recovery mechanisms.
• Timely incident detection, response, and resolution.
• Compliance with applicable government cybersecurity policies and standards.
• Successful implementation of employee cybersecurity awareness programs.