Chief Information Security Officer

Exchange Data International (EDI); India; On-site; INR 4,500,000 - 7,500,000; Full time

Job summary

Information Publishing Limited (IPL) Group is seeking a Chief Information Security Officer (CISO) to develop and drive the group’s information security strategy across global subsidiaries. You will lead the ISMS, align with ISO 27001:2022, and ensure compliance with regulatory obligations and security best practices.

The role requires deep technical expertise, strong leadership, and the ability to translate risk into business priorities for revenue protection and digital strategy across IPL’s

Qualifications

• Bachelor's degree or equivalent in a relevant field and formal ISO 27001 training or certification.
• Significant leadership experience in information security governance and risk management.
• Ability to translate security risks into business priorities for senior stakeholders.

Responsibilities

• Develop and maintain an ISMS aligned with ISO 27001:2022 for IPL Group and subsidiaries.
• Lead risk assessments across information assets, IT, cloud, data, and third parties.
• Coordinate and oversee security controls, monitoring, incident response and reporting to executives.
• Ensure regulatory and contractual compliance across international operations and cross-border data flows.
• Lead security awareness, audits, and governance forums; drive continuous improvement.

Skills

Information security leadership

ISO 27001 knowledge

Risk management

Executive communication

Regulatory compliance

Education

Bachelor's degree in Computer Science/IT/Info Security

ISO 27001 training/certification

Job description

The Chief Information Security Officer (CISO) will be responsible for developing, implementing, managing and continually improving information security and cybersecurity strategies across Information Publishing Limited (IPL) Group companies operating globally.

The CISO will lead the IPL Group of companies’ Information Security Management System (ISMS), ensuring alignment with ISO/IEC 27001:2022 requirements, applicable regulatory obligations, contractual commitments and recognized information security best practices.

The position requires strong technical knowledge, proven information security leadership, practical ISO 27001 implementation experience and the ability to coordinate cybersecurity activities across multiple companies and countries.

Beyond traditional security operations, the role needs to encompass AI governance, data privacy/ integrity, regulatory compliance, and even physical security or ESG oversight.

This role should act as a business advisor who translates technical risks into business priorities to support decision-making regarding revenue, brand trust, and digital strategy.

MAIN DUTIES AND RESPONSIBILITIES:

Information Security Strategy and Governance

• Develop, implement and maintain a comprehensive information security and cybersecurity strategy aligned with the objectives of IPL Group and its subsidiaries.
• Establish and oversee information security policies, procedures, standards and guidelines.
• Identify and assess security risks within the organization in real time and implement appropriate security measures to mitigate risks.
• To conduct risk assessment activities and work in collaboration with IT teams to develop treatment plans.
• Ensure consistent security governance across all applicable IPL group companies and international offices.
• Establish effective security communication and reporting mechanisms between IPL group of companies and individual subsidiaries.
• Work closely with senior executives to develop comprehensive security strategies and support the IPL group of companies’ business objectives.
• Keep abreast of security threats and best practices and adjust security strategies and controls accordingly.

Information Security Risk Assessments

Perform or oversee information security risk assessments covering:

• Information assets and sensitive business information
• IT infrastructure and network environments
• Cloud servers and hosted applications
• Databases and data storage systems
• Software applications and APIs
• Automated data extraction and processing systems
• Third-party vendors and service providers
• Business continuity and disaster recovery
• Regulatory and contractual compliance

Technical Security Controls

Coordinate the implementation and effectiveness of security controls, including:

• Firewalls and network security
• Endpoint protection and Endpoint Detection and Response (EDR)
• Antivirus and anti-malware systems
• Identity and Access Management (IAM)
• Privileged Access Management (PAM)
• Vulnerability scanning and patch management
• Security monitoring and logging
• Data encryption and secure communication
• Backup and restoration systems
• Email and collaboration platform security

Work actively with IT Infrastructure teams to mitigate security risks and coordinate the management and implementation of security software.

ISMS Governance and ISO/IEC 27001:2022

• Manage and continually improve the ISMS framework, ISO 27001 policies, procedures and supporting records.
• Coordinate risk assessments across information assets and maintain the information security risk register.
• Maintain the Risk Treatment Plan, assigning responsibilities, actions and target dates, and tracking progress.
• Maintain and periodically review the Statement of Applicability (SoA).
• Oversee security incident reporting, corrective actions and improvement opportunities.
• Collect and review ISMS measurement and performance metrics, and monitor the effectiveness of controls and policies.
• Coordinate Information Security Forum (ISF) and management review meetings, including preparation and retention of minutes and action records.
• Monitor implementation of security awareness training and compliance with relevant quality and security policies.

Regulatory Compliance and International Security Requirements

• Ensure that information security practices are aligned with applicable laws, regulations, industry standards and contractual security requirements.
• Coordinate compliance assessments across IPL group companies and international business operations.
• Work with Legal, Compliance and relevant management teams to identify applicable data protection and cybersecurity requirements.
• Support compliance with applicable international data protection obligations, including relevant UK, European, Indian and US requirements.
• Assess security risks associated with international data transfers and cross-border information sharing.
• Review customer and third-party contractual information security obligations.
• Monitor relevant changes to security regulations, standards and best practices.
• Recommend changes to IPL group companies’ policies and controls when regulatory requirements change.
• Maintain appropriate security compliance records and evidence for management review and external assessments.

Internal Audits, External Audits and Certification

• Coordinate and participate in external information security audits.
• Develop and maintain an annual ISMS internal audit programme across IPL group companies.
• Ensure internal audits are conducted objectively and independently of the activities being audited.
• Coordinate with ISO 27001 certification bodies, external auditors, consultants and relevant stakeholders.
• Prepare and maintain documentation and evidence required for ISO certification and surveillance audits.

Customer Due Diligence and Security Questionnaires

• Take responsibility for coordinating and oversight or manage information security-related customer due diligence questionnaires (DDQs).
• Work closely with Sales, Business Development, Legal, IT Infrastructure and operational teams to respond to customer security assessments.
• Review and validate responses to information security questionnaires, supplier assessments and customer compliance requests.
• Identify and manage information security commitments arising from customer contracts and due diligence assessments.
• Support Sales and Business Development teams during client onboarding, vendor registration and contract renewal activities.

Security Awareness, Leadership and Incident Support

• Educate staff on appropriate information security practices and applicable regulatory requirements.
• Mentor and support information security professionals, providing guidance and training as required.
• Ensure staff under the CISO’s supervision perform their duties in accordance with applicable policies and procedures.
• Support major information security incidents, including agreed on-call escalation and incident response responsibilities.
• Produce concise risk, security performance and financial impact reports for executive and Board-level management.
• Carry out other reasonable duties related to the role as required.

PERSON SPECIFICATION:

Education and Professional Qualifications – Essential

• Bachelor's degree in Computer Science, Information Technology, Information Security, Cybersecurity or a related or equivalent professional experience.
• Strong knowledge of information security principles, standards, frameworks and practices.
• Formal training or demonstrable professional expertise in ISO/IEC 27001 and information security risk management.
• Evidence of continuous professional development in cybersecurity, information security governance and management.

Professional Experience – Essential

• Minimum 10–15 years of relevant experience in information security, cybersecurity, IT security governance or technology risk management.
• Significant experience in a senior information security management or leadership position.
• Proven experience implementing, managing and maintaining an ISO 27001-based ISMS.
• Demonstrated expertise in IT security, risk management, incident management and technical control oversight.
• Ability to communicate complex security issues to executives, technical teams and other stakeholders.
• Strong analytical, problem-solving, project management, delegation and decision-making skills.

Other Job Requirements

• Permanent India-based role supporting globally for IPL Group of companies and cross-border stakeholders.
• Flexible working during peak periods, major incidents, project go-lives or system switchovers as required by the employment contract.
• Maintain professional integrity, openness, confidentiality and respect for diverse perspectives.