Information Security Manager

Mondee; Hyderabad; On-site; INR 3,500,000 - 7,000,000; Full time

Job summary

Mondee is seeking a seasoned security leader in Hyderabad to own and scale our enterprise security program. You will set strategic direction for information security, build board-level trust, and guide a growing team through rapid technology transformation, including secure AI systems central to our product.

You will drive risk management, governance, and compliance across ISO 27001, SOC 2, GDPR, and more, while embedding security into the SDLC and leading cloud posture across AWS/Azure/GCP.

Qualifications

• 8-9 years of information security leadership experience.
• Experience in governance, risk management, and compliance initiatives.
• Hands-on with monitoring/alerting tools like Splunk, Datadog, or Azure Sentinel.

Responsibilities

• Define and drive the organization's information security and cyber risk strategy.
• Lead enterprise-wide GRC initiatives – policy, standards, controls.
• Build board-level visibility into security posture and risk themes.
• Ensure alignment with ISO 27001, SOC 2, GDPR, PCI-DSS, NIST, and CMMC/FedRAMP as applicable.
• Own cloud security posture across AWS, Azure, GCP and CNAPP/CSPM.
• Embed security into the SDLC via DevSecOps practices and secure code gates.
• Strengthen security operations with SIEM/XDR, threat detection, and incident response.
• Drive AI security capabilities and governance over AI/LLM usage.

Skills

Security leadership

GRC strategy

Board-level reporting

Tools

Splunk

Datadog

Azure Sentinel

Job description

Work Mode:- WFO

Notice:- Immediate to 30days

About the Role

We're looking for a seasoned security leader with 8-9 years of experience to own and scale our enterprise security program. You'll set the strategic direction for information security and cyber risk, build board-level trust in our security posture, and lead a team through a period of rapid growth and technology transformation - including securing the AI systems now central to our product. This role blends governance and strategy with genuine hands-on depth: you'll be as comfortable presenting risk themes to the board as you are stress-testing an LLM for prompt injection.

What You'll Do

• Define and drive the organization's information security and cyber risk strategy, aligned with business objectives.
• Lead enterprise-wide Information Security Governance, Risk, and Compliance (GRC) initiatives - policy, standards, and control frameworks.
• Build board-level visibility into security posture, priorities, governance maturity, and enterprise risk themes.
• Ensure alignment with applicable regulations, standards, and audit requirements (ISO 27001, SOC 2, GDPR, PCI-DSS, NIST, CMMC/FedRAMP as applicable).

Cloud, Application & Infrastructure Security

• Own cloud security posture across AWS, Azure, and GCP - including CNAPP, CSPM, and workload protection for cloud-native and containerized environments.
• Embed security into the SDLC through DevSecOps practices: SAST/DAST, dependency scanning, and secure code review gates in CI/CD pipelines.
• Lead security initiatives spanning cloud, application, infrastructure, and data protection, plus broader cyber resilience.
• Own identity and access strategy - least-privilege access, MFA, and privileged access management (PAM).

Security Operations & Risk

• Strengthen security operations through automation, proactive threat detection (SIEM/XDR), incident response, and vulnerability management.
• Own incident response readiness - playbooks, tabletop exercises, and post-incident root-cause reviews.
• Lead third-party and vendor risk management, including security assessments of critical vendors and supply-chain risk.
• Drive adoption of AI-led security capabilities - AI-driven threat detection, SOC automation, and governance over the organization's own use of AI/LLM tools.
• Own security of the AI data pipeline: RAG access controls, vector database permissions, PII redaction in prompts and logs, and keeping customer data out of training and model memorization.
• Define least-privilege scoping for non-human identities and AI agents that touch bookings, payments, or PII, with clear tool and function-call boundaries.
• Evaluate third-party AI supply-chain risk - security review of model and API vendors, DPAs, and data-flow mapping for every external AI service.
• Build AI-specific incident response playbooks covering model misbehavior, AI-assisted social engineering, and deepfake-driven fraud.
• Threat-model agent workflows and build evaluation harnesses as part of a secure SDLC for AI features - not one-off checklist reviews.

Leadership & Culture

• Provide leadership and direction across security functions while enabling business growth and technology transformation.
• Partner closely with DevSecOps, Engineering, IT Operations, Cloud, Product, Privacy, Audit, and Business teams.
• Foster a strong security culture through awareness, enablement, accountability, and genuine business partnership.

What We're Looking For

Experience & Core Expertise

• 8-9 years of experience in Information Security / Cybersecurity leadership roles.
• Strong track record in security governance, strategy, cyber risk management, and enterprise security operations, with hands-on GRC tooling experience.
• Working knowledge of security regulations and frameworks, including ISO 27001, SOC 2, GDPR, PCI-DSS, NIST, and CMMC/FedRAMP where relevant.
• Global compliance exposure - comfortable navigating regulatory frameworks across the US, Middle East, India, and Europe.
• Proven experience leading cross-functional stakeholders and driving organization-wide security initiatives.
• Experience driving security transformation and automation, including hands-on work with monitoring/alerting tools such as Splunk, Datadog, or Azure Sentinel.
• Strong stakeholder management skills, with experience presenting to senior leadership and board-level forums.
• Experience working in regulated environments with direct exposure to regulatory and audit engagements.

AI Security Depth

• Hands-on AI red-teaming experience - prompt injection, jailbreak resistance, and data exfiltration through LLM outputs. You should have actually broken models, not just read about it.
• Practical understanding of AI regulation, including EU AI Act obligations for high-risk systems, alongside SOC 2, ISO 27001, GDPR, and India's DPDP Act.
• Familiarity with CNAPP, cloud-native security, DevSecOps, and modern enterprise security architecture.

Nice to Have

• Prior experience in fintech, insurtech, internet, SaaS, or other large-scale digital organizations.
• Relevant certifications such as CISSP, CISM, CCSP, CISA, or ISO 27001 Lead Implementer/Auditor.