Chief Information Security Officer

ECL Finance Limited; Mumbai; On-site; INR 4,000,000 - 7,000,000; Full time

Job summary

ECL Finance Limited seeks a Chief Information Security Officer to establish and maintain the enterprise information security, cyber risk management, data protection, and AI governance framework. The role ensures confidentiality, integrity, and availability of information assets while aligning security with business objectives and regulatory requirements.

Key responsibilities include leading ISMS development, defining cyber security strategy, managing risk assessments, and overseeing security

Qualifications

• 6–8 years of IT and cyber security experience in a large organization.
• Master’s degree in technology/science/computer applications; CISSP/CISA/CISM certifications.
• Experience in ISMS development and security governance is preferred.

Responsibilities

• Develop and maintain the enterprise-wide Information Security Management System (ISMS).
• Define and execute the organization's cyber security strategy, roadmap, policies, standards, and procedures.
• Lead enterprise risk assessments and establish appropriate risk mitigation measures.
• Ensure protection of critical business applications, customer data, digital channels, and infrastructure.
• Oversee security monitoring, vulnerability management, penetration testing, threat intelligence, and incident response programs.
• Manage cyber security operations, including SOC, SIEM, endpoint protection, and cloud security controls.
• Ensure compliance with RBI Cyber Security Framework, Digital Lending Guidelines, Data Privacy Regulations, and other regulatory requirements.
• Drive compliance with ISO 27001, NIST, PCI-DSS, and other relevant security frameworks.
• Coordinate internal and external security audits and address observations within agreed timelines.
• Present cyber risk posture, security incidents, and compliance status to senior management and Board/IT Committee.
• Provide security oversight for application development, cloud platforms, infrastructure, and third-party integrations.
• Review and approve technology architecture from an information security perspective.
• Establish secure software development and DevSecOps practices.
• Oversee vendor risk assessments and third-party security management.
• Develop and implement an AI Governance Framework covering responsible AI usage, security, privacy, and compliance.
• Partner with business and technology teams to securely adopt AI solutions while maintaining regulatory compliance.
• Monitor emerging AI security trends, threats, and regulatory developments.
• Work closely with business leaders to embed security into organizational processes.
• Conduct security awareness and cyber resilience programs across the organization.
• Build and lead a high-performing information security team.
• Engage with regulators, auditors, technology partners, and industry forums on security matters.

Skills

Information Security

Cyber Risk Management

Data Privacy

Security Leadership

Education

Master’s in technology/science/computer applications

Job description

The Chief Information Security Officer will be responsible for establishing, implementing, and maintaining the organization's information security, cyber risk management, data protection, and AI governance framework. The role will ensure the confidentiality, integrity, and availability of information assets while aligning security initiatives with business objectives, regulatory requirements, and emerging technology risks.

Qualifications & Experience

Experience: 6–8 years

• Master’s in technology/science/computer application. CISSP/CISA and CISM Certified. 6 to 8 years’ experience in IT and Cyber Security with large organization.

Key Responsibilities

Information Security & Cyber Risk Management

• Develop, implement, and continuously enhance the enterprise-wide Information Security Management System (ISMS).
• Define and execute the organization's cyber security strategy, roadmap, policies, standards, and procedures.
• Lead enterprise risk assessments and establish appropriate risk mitigation measures.
• Ensure protection of critical business applications, customer data, digital channels, and infrastructure.
• Oversee security monitoring, vulnerability management, penetration testing, threat intelligence, and incident response programs.
• Manage cyber security operations, including SOC, SIEM, endpoint protection, and cloud security controls.

Regulatory & Compliance

• Ensure compliance with RBI Cyber Security Framework, Digital Lending Guidelines, Data Privacy Regulations, and other applicable regulatory requirements.
• Drive compliance with ISO 27001, NIST, PCI-DSS, and other relevant security frameworks.
• Coordinate internal and external security audits and address observations within agreed timelines.
• Present cyber risk posture, security incidents, and compliance status to senior management and Board/IT Committee.
• Provide security oversight for application development, cloud platforms, infrastructure, and third-party integrations.
• Review and approve technology architecture from an information security perspective.
• Establish secure software development and DevSecOps practices.
• Oversee vendor risk assessments and third-party security management.

AI Security & Governance

• Develop and implement an AI Governance Framework covering responsible AI usage, security, privacy, and compliance.
• Partner with business and technology teams to securely adopt AI solutions while maintaining regulatory compliance.
• Monitor emerging AI security trends, threats, and regulatory developments.

Leadership & Stakeholder Management

• Work closely with business leaders to embed security into organizational processes.
• Conduct security awareness and cyber resilience programs across the organization.
• Build and lead a high-performing information security team.
• Engage with regulators, auditors, technology partners, and industry forums on security matters.

Information Security Governance

Security Operations & Incident Response