Head of Security

Scrut Automation Inc.; India; Remote; INR 3,500,000 - 5,500,000; Full time

Job summary

Scrut Automation is seeking a hands-on Head of Security to own application security, security operations, and corporate security. You will lead incident response, manage the SOC, and drive secure development across our SaaS platform in a fast-growing global environment.

You will partner with engineering and executives to speed delivery while maintaining strong security posture, overseeing cloud security (AWS preferred) and compliance programs such as SOC 2 and ISO 27001.

Qualifications

• 6+ years in security.
• Led incident response for high-severity incidents (breaches, ransomware, etc.).
• Strong AppSec background with secure SDLC in SaaS.
• Experience leading in-house SOC and managing MDR/MSSP with SLAs.
• Solid cloud security skills, ideally AWS.
• Familiar with MITRE ATT&CK, OWASP Top 10 and NIST guidance.
• Calm under pressure; clear communicator to engineers and executives.

Responsibilities

• Own application security: threat modelling, design reviews, and secure coding standards.
• Integrate security tooling into CI/CD (SAST, DAST, SCA, secrets, IaC).
• Manage product vulnerability process: triage, SLAs, pen tests, bug bounty.
• Secure a multi-tenant SaaS platform: authn/z, API security, data protection.
• Lead SOC and MDR: 24x7 monitoring, alert triage, escalation, response quality.
• Own incident response program: playbooks, on-call, blameless post-incident reviews.
• Oversee threat intelligence and threat hunting across cloud, corporate, and product.

Skills

Security leadership

Incident response

AppSec

SOC management

Cloud security

SIEM / SOAR / EDR-XDR

Tools

SIEM

SOAR

EDR/XDR

AWS GuardDuty / CloudTrail

Job description

About The Role

We want a hands-on security leader who has been in the room when things broke and led the response. You'll own Scrut's application security, security operations, and corporate security, and be the person customers and leadership trust when something goes wrong.

Title:

Head of Security

Location:

Bangalore, India Remote

About The Role

We want a hands-on security leader who has been in the room when things broke and led the response. You'll own Scrut's application security, security operations, and corporate security, and be the person customers and leadership trust when something goes wrong.

What You'll Own

Application security

• Own the secure SDLC: threat modelling, security design reviews, and secure coding standards.
• Build security tooling into CI/CD: SAST, DAST, SCA, secrets scanning, and IaC scanning, with fixes that engineers can actually act on.
• Own vulnerability management for the product: triage, remediation SLAs, pen tests, and a bug bounty or responsible disclosure program.
• Secure a multi-tenant SaaS platform, including tenant isolation, authentication and authorization, API security, and data protection.
• Secure AI and LLM features against prompt injection, data leakage, and model and vendor risk.
• Work as a partner to engineering leaders so security speeds teams up instead of blocking them.
• Support SOC 2 and ISO 27001 controls and customer security reviews, working with the GRC team.

Security operations and incident response

• Own Scrut's existing SOC team and MDR partnership. You'll lead the in-house SOC, manage the MDR relationship, scope, and SLAs, and keep raising the bar on 24x7 monitoring, alert triage, escalation, and response quality.
• Own detection engineering: what we log, the SIEM and EDR stack, detection rules, and tuning to cut noise.
• Own the incident response program: playbooks, severity levels, on-call, war rooms, and blameless post-incident reviews that lead to real fixes.
• Lead live incidents from detection through containment, eradication, recovery, and customer and regulatory notification.
• Run regular tabletop exercises and red team or purple team drills.
• Own threat intelligence and threat hunting for our cloud, corporate, and product environments.

Corporate security

• Secure corporate IT: identity and SSO, MFA, device management, endpoint protection, and email security.

What We're Looking For

• 6+ years in security.
• Battle-tested incident leadership. You've personally led response to real, high-severity incidents (breaches, ransomware, account takeovers, cloud compromises, or major vulnerabilities like Log4Shell) and can walk us through what happened, what you decided, and what you changed afterwards.
• Strong AppSec background: you've built a secure SDLC program at a SaaS company and can review architecture and code yourself.
• Experience leading an in-house SOC team and managing an MDR or MSSP provider, including holding them to SLAs, with deep familiarity with SIEM, SOAR, EDR/XDR, and cloud-native detection (AWS GuardDuty, CloudTrail, Security Hub, or equivalents).
• Solid cloud security skills, ideally AWS.
• Experience securing corporate IT and identity.
• Working knowledge of MITRE ATT&CK, OWASP Top 10 and ASVS, and NIST incident response guidance.
• Calm under pressure, a clear communicator during incidents, and able to brief both engineers and executives.

Nice to have

• Experience at a B2B SaaS, security, or compliance company.
• Certifications such as GCIH, GCIA, OSCP, OSWE, or CISSP.
• Digital forensics experience.
• Experience securing AI/LLM products

Why should this job excite you?

• A chance to make real impact early - not just be a cog in the wheel
• Rapid learning, faster growth - we don't gatekeep opportunities
• You'll work with smart, driven folks who genuinely want to build something meaningful
• Exposure to founders and leadership that actually mentor and listen
• Your ideas won't just be heard - they'll be implemented
• Competitive pay, great benefits, and policies that respect your time and energy
• We're building for a global market - your work scales beyond borders

About Us

Scrut Automation is an information security and compliance monitoring platform aimed at helping small and medium cloud-native enterprises develop and maintain a robust security posture and comply with various infosec standards such as SOC 2, ISO 27001, GDPR, and the like with ease. With the help of the Scrut platform, customers reduce their manual effort for security and compliance tasks by 70% and build real-time visibility of their security posture. Founded by IIT/ISB/McKinsey alumni, the founding team has over 15 years of combined Infosec experience. Scrut is built out of India for the world, with customers across India, APAC, North America, Europe and the Middle East. Scrut is backed by Lightspeed Ventures, MassMutual Ventures and Endiya Partners, along with prominent angels from the global SaaS community.

Note:

Due to a high volume of applications, only shortlisted candidates will be contacted. Thank you for your understanding.