Information Security Manager

Sunflower Lab; Vadodara; On-site; INR 4,000,000 - 7,000,000; Full time

Job summary

Sunflowerlab in Vadodara, India seeks an experienced Information Security Manager to lead the organization's security program. You will establish policies, oversee audits, manage incidents, and drive security improvements across engineering, DevOps, IT, QA, and business teams.

The role requires strong governance, risk management, secure coding practices, and the ability to collaborate with multiple stakeholders while ensuring compliance with HIPAA, SOC 2, ISO 27001, and NIST as applicable.

Qualifications

• Bachelor's degree in CS/IT/Cybersecurity or related field.
• 8–12 years of information security experience.
• At least 3 years in security management, governance or senior leadership.
• Strong knowledge of governance, risk assessments, vulnerability management, and auditing.

Responsibilities

• Own and manage the organization's information security program, policies, standards, and procedures.
• Conduct periodic security audits across Engineering, DevOps, IT, QA, and other departments.
• Identify security vulnerabilities, compliance gaps, operational risks, and recommend corrective actions.
• Establish and maintain security risk registers, remediation plans, and compliance documentation.
• Oversee application, infrastructure, cloud, database, and network security practices.
• Ensure secure software development practices and security controls are implemented across engineering teams.
• Manage security incidents, investigations, root-cause analysis, incident reporting, and corrective actions.
• Establish security monitoring, vulnerability management, access control, and security review processes.
• Ensure compliance with HIPAA, SOC 2, ISO 27001, and NIST, as applicable.
• Prepare security assessment reports, risk summaries, and recommendations for executive leadership.
• Drive security awareness and training programs across the organization.
• Monitor remediation activities and ensure identified security issues are resolved within agreed timelines.

Skills

Security governance

Risk management

Incident management

Security audits

Leadership

Communication

Documentation

Analytical skills

Education

Bachelor's degree in Computer Science, Information Technology, Cybersecurity

Job description

Department: Information Security / Technology

Position Type: Full-Time

Experience Level: Senior / Management

Scope: Organization-wide, including all technology and business departments

Experience: 7-10 Years

About the Role

We are looking for an experienced Information Security Manager to lead and oversee the organization's information security program.

The individual will be responsible for establishing security policies and standards, ensuring security practices are implemented across all departments, conducting security audits, identifying risks, managing security incidents, and driving continuous improvement of the organization's security posture.

This role requires a combination of strong technical cybersecurity knowledge, security governance expertise, risk management experience, and the ability to work independently with engineering, DevOps, IT, QA, and business teams.

The successful candidate will serve as the primary point of contact for all information security matters across the organization.

Key Responsibilities

• Own and manage the organization's information security program, policies, standards, and procedures.
• Conduct periodic security audits and assessments across Engineering, DevOps, IT, QA, and other departments.
• Identify security vulnerabilities, compliance gaps, operational risks, and recommend corrective actions.
• Establish and maintain security risk registers, remediation plans, and compliance documentation.
• Oversee application, infrastructure, cloud, database, and network security practices.
• Ensure secure software development practices and security controls are implemented across engineering teams.
• Manage security incidents, investigations, root-cause analysis, incident reporting, and corrective actions.
• Establish security monitoring, vulnerability management, access control, and security review processes.
• Ensure compliance with applicable security standards and regulatory requirements, including HIPAA, SOC 2, ISO 27001, and NIST, as applicable.
• Prepare security assessment reports, risk summaries, and recommendations for executive leadership.
• Drive security awareness and training programs across the organization.
• Monitor remediation activities and ensure identified security issues are resolved within agreed timelines.

Required Qualifications and Skills

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field.
• 8–12 years of experience in information security, cybersecurity, or IT security.
• At least 3 years of experience in security management, governance, risk management, or a senior security leadership role.
• Strong understanding of security governance, risk assessments, vulnerability management, and security auditing.
• Practical knowledge of application security, OWASP Top 10, secure coding practices, API security, and authentication mechanisms.
• Experience with cloud security (AWS/Azure), infrastructure security, database security, network security, and access management.
• Experience managing security incidents, investigations, and remediation activities.
• Demonstrated experience developing and implementing security policies, procedures, and organizational security controls.
• Strong communication, documentation, analytical, and leadership skills.

Preferred Qualifications

• CISSP, CISM, CISA, CCSP, or ISO 27001 Lead Auditor / Lead Implementer certification.
• Experience in healthcare technology or organizations handling sensitive patient information.
• Practical knowledge of HIPAA Security Rule, SOC 2, and ISO 27001 requirements.
• Experience with AWS cloud security and SaaS application security.
• Experience conducting internal security audits and coordinating external security assessments.

What We Are Looking For

• A self-driven professional capable of independently managing the organization's security program.
• Someone who can technically evaluate security implementations rather than relying solely on reports from other teams.
• Ability to identify security gaps, challenge existing practices, and drive corrective actions.
• Strong ownership and accountability for organization-wide security.
• Ability to communicate technical risks and provide clear, actionable recommendations to management.

Our expectation: The individual will take ownership of the organization's security posture, ensure security best practices are followed across all departments, and continuously improve the organization's overall security maturity.