General Manager - Information Security & CISO (ICDIA)

National Institute for Smart Government (NISG); New Delhi; On-site; INR 3,500,000 - 5,500,000; Full time

Job summary

National Institute for Smart Government (NISG) invites a General Manager Information Security / CISO to lead ICDIA’s security strategy across assets, platforms, and services. You will direct governance, risk management, incident response, and security architecture in collaboration with senior leadership and IT teams.

You will mentor the security function, promote a culture of security ownership, and align policies with regulatory standards and industry best practices while overseeing budgeting

Qualifications

• 12–18 years in information security or related areas.
• At least 5 years in leadership roles.
• Experience developing and implementing information security strategies, governance frameworks, and controls.
• Hands-on with security technologies: firewalls, IAM, encryption, vulnerability management.

Responsibilities

• Develop and implement enterprise-wide information security and cybersecurity strategy.
• Establish governance mechanisms for effective policy implementation and monitoring.
• Identify, assess, and manage information security risks across systems and platforms.
• Lead incident response, business resilience, and cyber crisis management.

Skills

Leadership

Information Security

Strategic planning

Risk management

Communication

Education

Bachelor’s degree in CS/IT/Cybersecurity

Master’s degree in Cybersecurity (advantage)

CISSP/CISM/CISA certifications

Job description

Role Overview

The General Manager Information Security / Chief Information Security Officer (CISO) will be responsible for establishing, strengthening, and overseeing ICDIA’s information security framework to protect its information assets, technology infrastructure, applications, systems, and digital platforms.

The role will lead the development and implementation of an enterprise-wide information security strategy aligned with organizational objectives, risk management priorities, and applicable regulatory and industry requirements. The incumbent will provide strategic direction on cybersecurity, information security governance, risk management, incident response, security architecture, compliance, and security awareness.

The role will work closely with senior leadership, IT and engineering teams, business functions, technology partners, and other stakeholders to establish a proactive, risk-based, and resilient information security environment across ICDIA.

2. Key Responsibilities

2.1 Strategic Planning & Information Security Strategy

• Develop and implement an enterprise-wide information security and cybersecurity strategy aligned with ICDIA’s organizational objectives and risk management framework.
• Establish security priorities, roadmaps, controls, and initiatives based on evolving business and technology requirements.
• Identify emerging cybersecurity risks and technologies and recommend appropriate measures to strengthen ICDIA’s security posture.
• Provide strategic advice to senior leadership on information security risks, priorities, and mitigation measures.

2.2 Information Security Policy & Governance

• Develop, review, update, and implement information security policies, procedures, standards, guidelines, and control frameworks.
• Establish appropriate governance mechanisms to ensure effective implementation and monitoring of information security controls.
• Ensure alignment with applicable regulatory requirements, contractual obligations, and recognized information security standards.
• Promote accountability and adherence to information security policies across the organization.

2.3 Risk Management & Security Assessments

• Identify, assess, prioritize, and manage information security and cybersecurity risks across systems, applications, infrastructure, and digital platforms.
• Conduct or oversee periodic security audits, vulnerability assessments, risk assessments, and security reviews.
• Establish appropriate risk mitigation and remediation plans and monitor their implementation.
• Assess security risks associated with third-party vendors, technology partners, applications, and services.

2.4 Incident Response & Business Resilience

• Establish and oversee an effective information security incident response framework.
• Lead and coordinate the response to significant security incidents, breaches, vulnerabilities, and cyber threats.
• Develop, maintain, and periodically test incident response plans and procedures.
• Coordinate with relevant internal teams and external stakeholders during security incidents.
• Support business continuity, disaster recovery, and cyber resilience initiatives from an information security perspective.

2.5 Security Architecture & Technology Management

• Evaluate and recommend appropriate security technologies, tools, and solutions based on organizational requirements and risk exposure.
• Ensure that security controls are appropriately integrated into IT infrastructure, applications, networks, cloud environments, and digital platforms.
• Provide security guidance for new technology implementations, application development, system integration, and digital transformation initiatives.
• Monitor the effectiveness of deployed security technologies and recommend improvements where required.

2.6 Leadership & Stakeholder Management

• Lead, guide, and mentor the information security and cybersecurity function/team.
• Establish a culture of security ownership and accountability across technology and business functions.
• Communicate security risks, incidents, compliance matters, and strategic priorities effectively to senior management and relevant stakeholders.
• Work closely with IT Engineering, technology, business, legal, compliance, and other teams to embed security into organizational processes.

2.7 Security Awareness & Training

• Develop and implement information security awareness and training programmes for employees and relevant stakeholders.
• Promote awareness of cybersecurity threats, data protection, secure technology practices, and information security responsibilities.
• Conduct periodic awareness initiatives, communication campaigns, and training sessions based on emerging risks and organizational requirements.

2.8 Compliance, Audit & Regulatory Requirements

• Ensure information security practices are aligned with applicable regulatory and statutory requirements and recognized industry standards.
• Coordinate with internal and external auditors, assessors, regulators, and relevant stakeholders, wherever applicable.
• Track audit observations, compliance gaps, and remediation activities.
• Maintain appropriate security documentation, records, evidence, and reporting mechanisms.

2.9 Budget & Resource Management

• Develop and manage the information security budget in alignment with organizational priorities and identified risks.
• Evaluate and justify investments in cybersecurity technologies, services, resources, and capabilities.
• Ensure effective utilization of security resources and continuous improvement of the information security function.

3. Educational Qualifications

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, Information Security, Engineering, or a related discipline from a recognized institution.
• A Master’s degree in Cybersecurity, Information Security, Technology Management, Computer Science, or a related field will be an added advantage.
• Industry-recognized certifications such as CISSP, CISM, CISA, or equivalent information security/cybersecurity certifications are highly desirable.
• Good understanding of applicable information security, data protection, privacy, and regulatory requirements.

4. Experience Required

• 12-18 years of relevant experience in information security, cybersecurity, IT risk, information assurance, or related areas, including at least 5 years in a leadership or managerial capacity.
• Proven experience in developing and implementing information security strategies, governance frameworks, policies, and security controls.
• Hands‑on understanding of security technologies and solutions, including firewalls, intrusion detection/prevention systems, endpoint security, identity and access management, encryption, vulnerability management, and security monitoring.
• Demonstrated experience in managing security incidents, cyber threats, vulnerabilities, and incident response processes.
• Experience in conducting or managing security assessments, audits, risk assessments, and compliance activities.
• Experience working with technology, IT infrastructure, engineering, cloud, application, and digital environments.
• Experience in managing security teams, technology partners, consultants, and other stakeholders will be an advantage.

5. Key Skills & Competencies

• Strong knowledge of Information Security and Cybersecurity principles, frameworks, and best practices.
• Enterprise security strategy and information security governance.
• Cybersecurity risk assessment and risk management.
• Security architecture and technology evaluation.
• Incident response and cyber crisis management.
• Vulnerability management and security assessment.
• Information security policies, standards, procedures, and controls.
• Data protection, privacy, and regulatory compliance.
• Security audit and compliance management.
• Identity and Access Management (IAM) and access controls.
• Network, endpoint, application, cloud, and infrastructure security.
• Strong analytical, problem-solving, and decision-making capabilities.
• Excellent leadership, stakeholder management, and communication skills.
• Ability to communicate complex security risks and technical matters to non-technical stakeholders and senior leadership.
• Strong project management and ability to manage multiple security initiatives simultaneously.
• Proactive approach to emerging cybersecurity threats, technologies, and industry developments.

6. Preferred / Relevant Exposure

• Experience in large organizations, technology-driven environments, government/public-sector institutions, international organizations, or digital ecosystems.
• Exposure to Digital Public Infrastructure (DPI), digital transformation, digital governance, or large-scale technology platforms will be an added advantage.
• Experience with recognized information security and cybersecurity frameworks and standards.
• Exposure to cloud security, application security, DevSecOps, Security Operations Centre (SOC), Security Information and Event Management (SIEM), Zero Trust, and identity security will be preferred.
• Experience in managing third-party/vendor security risks and technology partnerships.
• Exposure to business continuity, disaster recovery, cyber resilience, and crisis management frameworks.
• Experience working in multi-stakeholder, national, or international technology environments will be an advantage.