Chief Information Security Officer

Apcfss; NTR; On-site; INR 4,500,000 - 7,500,000; Full time

Job summary

APCFSS in Andhra Pradesh invites a senior cybersecurity leader to design and implement comprehensive information security strategies for government platforms, aligning with state IT policies and governance standards.

You will lead risk management, security operations, and compliance initiatives across enterprise applications, networks, and data, coordinating with government departments, auditors, and technology partners to strengthen the state's digital infrastructure.

Qualifications

• Bachelor's or Master's degree in computer science, IT, cybersecurity, or a related discipline.
• Postgraduate qualification in cybersecurity or management preferred.
• Professional certifications such as CISSP, CISM, CISA, CRISC, CEH, or ISO 27001 Lead Auditor/Lead Implementer preferred.

Responsibilities

• Develop and implement cybersecurity strategy and governance aligned with government policies.
• Lead risk management across enterprise applications, infrastructure, and data.
• Oversee SOC operations, SIEM, and incident response capabilities.
• Ensure compliance with IT Acts, CERT-In directives, and ISO 27001/NIST standards.
• Coordinate with government departments, auditors, and vendors on security programs.

Skills

Cybersecurity governance

Risk management

Application security

Security operations

Data protection

Incident management

Vendor management

Education

Bachelor's/Master's in CS/IT/Cybersecurity

Postgraduate in Cybersecurity/Management

Certifications: CISSP/CISM/CISA/CEH

Job description

2. Key Roles & Responsibilities

2.1 Cybersecurity Strategy & Governance

• Develop and implement comprehensive information security and cybersecurity strategies for APCFSS.
• Establish security policies, standards, guidelines, procedures, and governance frameworks.
• Align cybersecurity initiatives with Government of Andhra Pradesh IT policies and organizational objectives.
• Advise senior management on cybersecurity risks, security priorities, and mitigation strategies.
• Establish security controls to protect mission-critical government applications and information systems.

2.2 Information Security Risk Management

• Identify, assess, prioritize, and manage cybersecurity risks across enterprise applications, infrastructure, networks, and databases.
• Conduct periodic Information Security Risk Assessments (ISRA), security audits, and vulnerability assessments.
• Oversee Vulnerability Assessment and Penetration Testing (VAPT) activities.
• Develop risk mitigation and remediation plans and monitor their implementation.
• Evaluate security risks associated with third-party vendors, system integrators, cloud service providers, and technology partners.

2.3 Application & Infrastructure Security

• Ensure security of critical government applications, including CFMS and other e-Governance platforms.
• Oversee security architecture for web applications, mobile applications, APIs, databases, and enterprise systems.
• Implement secure application development practices and conduct periodic application security reviews.
• Establish access management, authentication, encryption, and database security mechanisms.
• Ensure security controls are incorporated throughout the Software Development Life Cycle (SDLC).

2.4 Cybersecurity Operations & Incident Management

• Establish and oversee Security Operations Centre (SOC) functions and security monitoring mechanisms.
• Implement SIEM, intrusion detection, endpoint protection, and threat monitoring solutions.
• Develop and maintain cybersecurity incident response plans and escalation procedures.
• Lead responses to cyberattacks, data breaches, unauthorized access, and other security incidents.
• Coordinate with relevant government cybersecurity agencies and CERT-In, as required.
• Conduct post-incident investigations and implement corrective and preventive measures.

2.5 Regulatory Compliance & Security Audits

• Ensure compliance with applicable Government of India and Government of Andhra Pradesh cybersecurity policies, guidelines, and regulatory requirements.
• Implement relevant security standards such as ISO 27001 and the NIST Cybersecurity Framework.
• Ensure compliance with applicable CERT-In directions, IT Act requirements, and data protection regulations.
• Coordinate internal and external security audits, regulatory inspections, and compliance assessments.
• Lead responses to audit observations and regulatory requests.
• Maintain security documentation, compliance reports, and audit records.

2.6 Data Security & Privacy Management

• Establish data protection and privacy policies for government financial and administrative information.
• Ensure confidentiality, integrity, and availability of critical government data.
• Implement data classification, encryption, backup, access control, and Data Loss Prevention (DLP) mechanisms.
• Protect sensitive financial transactions, employee information, beneficiary data, and departmental records.
• Ensure secure data exchange and integration between government departments and external systems.
• Monitor and prevent unauthorized data access, disclosure, and misuse.

2.7 Business Continuity & Disaster Recovery

• Develop and implement Business Continuity Plans (BCP) and Disaster Recovery Plans (DRP).
• Establish disaster recovery strategies for critical applications, databases, and infrastructure.
• Ensure regular backup, restoration, and disaster recovery testing.
• Define Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) for critical systems.
• Ensure continuity of essential government financial and e-Governance services during disruptions.

2.8 Vendor & Third-Party Security Management

• Evaluate and manage cybersecurity risks associated with technology vendors, system integrators, cloud service providers, data centres, and outsourced service providers.
• Establish and enforce third-party security policies, guidelines, and cybersecurity requirements in vendor contracts, MoUs, and Service-Level Agreements (SLAs).
• Conduct periodic third-party security assessments, audits, and compliance reviews, including evaluation of vendor security architecture, infrastructure, and data protection practices before onboarding.
• Monitor and control vendor access to organizational systems, applications, databases, and sensitive information, ensuring appropriate security controls throughout outsourced IT operations.
• Ensure timely reporting of security incidents, data breaches, and vulnerabilities by vendors, and periodically review their business continuity and disaster recovery arrangements to ensure uninterrupted services.

2.9 Cybersecurity Awareness & Training

• Develop and implement cybersecurity awareness programs for APCFSS employees and project teams.
• Conduct periodic training on phishing, data protection, password security, and safe IT practices.
• Promote cybersecurity awareness among government department users of APCFSS-managed applications.
• Conduct security drills and awareness campaigns to improve organizational preparedness.

2.10 Team Leadership & Stakeholder Management

• Lead and manage information security and cybersecurity teams.
• Coordinate with IT infrastructure, application development, database, SAP, and project management teams.
• Work closely with government departments, regulatory authorities, security auditors, and technology partners.
• Present cybersecurity status, risks, incidents, and compliance reports to senior management.
• Provide strategic recommendations for improving APCFSS's overall information security posture.

3. Educational Qualifications

• Bachelor's or masters degree in computer science, Information Technology, Cybersecurity, Information Security, or a related discipline.
• Postgraduate qualification in Cybersecurity, Information Security, or Management is an added advantage.
• Professional certifications such as CISSP, CISM, CISA, CRISC, CEH, ISO 27001 Lead Auditor, or Lead Implementer are preferred.

4. Required Experience

• 15–20+ years of overall experience in IT, Information Security, or Cybersecurity.
• Minimum 5–8 years of experience in senior cybersecurity leadership positions.
• Proven experience in developing and implementing enterprise-wide cybersecurity strategies.
• Experience managing large-scale government IT systems, financial applications, ERP platforms, or e-Governance projects.
• Strong experience in cybersecurity governance, risk management, VAPT, security audits, and incident management.
• Experience coordinating with government departments, regulatory authorities, auditors, and third‑party technology vendors.
• Experience in public‑sector, BFSI, government technology, or large enterprise environments will be preferred.

5. Technical Skills & Expertise

Skill Area

Expected Expertise

Cybersecurity Governance

ISO 27001, NIST, Security Policies

Risk Management

ISRA, VAPT, Risk Mitigation

Application Security

OWASP, Secure SDLC, API Security

Infrastructure Security

Network, Server, Endpoint Security

Enterprise Security

SAP, ERP, Database Security

Security Operations

SOC, SIEM, Threat Monitoring

Data Protection

Encryption, DLP, Access Controls

Incident Management

Incident Response, Forensics

Compliance

CERT-In, IT Act, Applicable Government Guidelines

Business Continuity

BCP, DRP, RTO, RPO

Vendor Management

Third-Party Risk Assessment

6. Key Performance Indicators (KPIs)

• Strengthening of APCFSS's overall cybersecurity and information security framework.
• Security compliance of critical government applications and IT infrastructure.
• Timely identification and resolution of security vulnerabilities.
• Reduction in cybersecurity incidents and data security risks.
• Successful completion of information security audits.
• Effective implementation and testing of disaster recovery mechanisms.
• Timely incident detection, response, and resolution.
• Compliance with applicable government cybersecurity policies and standards.
• Successful implementation of employee cybersecurity awareness programs.