Chief Information Security Officer

ETCIO - Cloud Data Center; Pune District; On-site; INR 2,000,000 - 2,500,000; Full time

Job summary

ETCIO - Cloud Data Center is seeking a Chief Information Security Officer (CISO) to lead the establishment and implementation of a comprehensive information security program. This pivotal role involves developing security frameworks that adhere to regulations and support rapid growth across rural India, safeguarding digital assets and customer data.

The ideal candidate will have 12+ years of experience in information security with a strong background in leadership roles and financial services. Required qualifications include key certifications and a deep understanding of the Indian regulatory landscape.

Qualifications

• 12+ years of progressive experience in information security, with at least 5 years in leadership roles.
• Professional security certifications required: CISSP, CISM, or equivalent.
• Experience in financial services, fintech, or NBFC environment strongly preferred.

Responsibilities

• Develop and execute a comprehensive information security strategy aligned with business objectives.
• Lead security incident response efforts and coordinate with stakeholders.
• Build and lead a security vertical capable of supporting distributed operations across 38,000+ villages.

Skills

Leadership skills

Risk management

Cybersecurity knowledge

Regulatory compliance

Fraud prevention

Education

Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or related field

Master's degree preferred

Tools

Security assessment tools

Cloud security tools

Job description

Job Description

Role Overview

As the Chief Information Security Officer (CISO) at SarvaGram, you will be responsible for establishing, implementing, and maintaining a comprehensive information security program that protects the company's digital assets, customer data, and business operations. This critical leadership role requires building security frameworks that support the rapid growth across rural India while ensuring compliance with regulations set by RBI, IRDAI, and data protection laws. Your primary goal will be to safeguard the trust of over 150,000 served households and the expanding franchise network.

Key Responsibilities

• Develop and execute a comprehensive information security strategy aligned with business objectives and growth trajectory
• Establish and maintain an enterprise-wide information security governance framework, policies, standards, and procedures
• Build and lead a security vertical capable of supporting distributed operations across 38,000+ villages
• Serve as the primary security advisor to the CEO, Board of Directors, and senior leadership team
• Own the security budget and ensure optimal resource allocation for maximum risk reduction

Risk Management & Compliance

• Design and implement a robust risk management framework for identifying, assessing, and mitigating information security risks
• Ensure compliance with RBI cybersecurity guidelines, IRDAI requirements, IT Act 2000, DPDPA 2023, and other Indian regulations
• Manage third-party security assessments, audits, and certifications
• Conduct regular security risk assessments and present findings to senior management and board

Security Architecture & Operations

• Design secure technology architecture for digital lending platform, mobile applications, and franchise management systems
• Implement and oversee security operations center (SOC) capabilities
• Establish robust identity and access management (IAM) frameworks
• Secure data infrastructure including customer KYC data, financial records, and transaction information
• Implement data loss prevention (DLP), encryption, and data classification programs

Fraud Prevention & Detection

• Develop and implement comprehensive fraud detection and prevention strategies
• Establish controls to prevent identity theft, application fraud, and account takeover
• Implement transaction monitoring and anomaly detection systems
• Build fraud awareness programs for Branches and franchise network

Incident Response & Business Continuity

• Develop and maintain incident response plans and playbooks
• Lead security incident response efforts and coordinate with stakeholders
• Establish business continuity and disaster recovery plans
• Manage communication protocols for security incidents

Security For Distributed Operations

• Design security frameworks for Branches and rural operations
• Secure mobile-first and offline-capable systems
• Implement secure authentication and authorization for franchise partners
• Develop security training programs for franchise partners and field staff

Vendor & Third-Party Risk Management

• Establish vendor security assessment and monitoring programs
• Manage security requirements for partnerships
• Conduct security due diligence for new vendor relationships
• Ensure contractual security obligations are met

Security Awareness & Culture

• Build a security-first culture across the organization
• Develop and deliver comprehensive security awareness training programs
• Conduct regular phishing simulations and security awareness campaigns
• Create security champions program across different business units

Required Qualifications

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or related field (Master's degree preferred)
• Professional security certifications required: CISSP, CISM, or equivalent
• Additional certifications valued: CISA, CEH, CGEIT, CRISC, or cloud security certifications

Experience

• 12+ years of progressive experience in information security, with at least 5 years in leadership roles
• Experience in financial services, fintech, or NBFC environment strongly preferred
• Proven track record of building security programs in high-growth organizations
• Deep understanding of Indian regulatory landscape
• Experience working with board-level stakeholders

Technical Expertise

• Deep knowledge of security frameworks
• Expertise in cloud security
• Strong understanding of application security, API security, and secure SDLC
• Experience with security tools
• Knowledge of authentication technologies, encryption, and cryptography
• Understanding of mobile application security
• Familiarity with fraud detection systems and machine learning for security
• Demonstrable working knowledge of data privacy principles and data protection techniques