Lead-Information Security & Data Protection

UMBO IDTech Pvt. ltd; Bengaluru; On-site; INR 2,500,000 - 6,000,000; Full time

Job summary

Riskcovry is hiring for a Lead Information Security & Data Protection role in Bengaluru, India. The position focuses on serving as the DPO under DPDP Act 2023 and implementing data protection programmes across the organization.

You will oversee privacy policies, data retention, and consent management, while integrating Privacy by Design into the SDLC and data engineering practices. Strong incident management and regulatory notification experience are essential.

Qualifications

• 3+ years of experience in information security, data privacy, or a combined role in fintech/regulated industries.
• Knowledge of India's DPDP Act 2023 and implementing data protection programmes.
• Strong working knowledge of ISO 27001.

Responsibilities

• Act as the designated DPO under India's DPDP Act 2023 and other privacy laws.
• Maintain a data processing inventory with a documented lawful basis for all activities.
• Support privacy policies, data retention schedules, and consent management frameworks.
• Monitor Privacy by Design and Privacy by Default into SDLC and data engineering practices.
• Review DPAs, data sharing agreements, and privacy clauses in vendor contracts.
• Lead data breach response: detection, containment, regulatory notification, and post-incident review.
• Lead cybersecurity strategy, governance, and risk assessments based on industry standards.
• Develop and maintain an incident response programme for cybersecurity incidents and data breaches.

Skills

Information security

Data privacy

Regulatory compliance

Incident response

Communication skills

Education

B.Tech/M.Tech in CS/IT

MBA in Information Security

Job description

Lead-Information Security & Data Protection

Insurance is one of the largest financial products in the world, yet it remains one of the hardest to distribute digitally. We’re changing that!

Riskcovry is an AI-first insurtech infrastructure platform that enables banks, lenders, fintechs, telecom companies, and digital platforms to embed insurance directly into their products and customer journeys.

Our API-first platform powers the full lifecycle of digital insurance distribution — from product configuration and policy issuance to commissions, claims, and reporting. This allows enterprises to launch and scale insurance programs quickly without building complex insurance infrastructure or managing multiple insurer integrations.

Today, businesses use Riskcovry to embed protection products like credit life, motor, device protection, and microinsurance into lending, payments, mobility, and digital ecosystems.

We’re building the infrastructure layer that makes insurance programmable, globally, much like how payment infrastructure transformed digital commerce.

Riskcovry is a venture-funded company backed by leading fintech investors and recognized by the industry for innovation, including awards such as “Insurtech of the Year” and “Best AI Innovation for Insurance Distribution.” Our platform powers digital insurance distribution across India, the Middle East, the UK, and expanding global markets.

Behind the platform is a team of builders, operators, and problem-solvers working at the intersection of insurance, technology, and financial services. We move fast, think boldly, and are driven by the opportunity to solve complex real-world problems at scale.

Act as the designated DPO under India's DPDP Act 2023 and other applicable privacy laws.

Maintain a data processing inventory with a documented lawful basis for all activities under the DPDPA Act 2023.

Support the development and maintenance of privacy policies, data retention schedules, and consent management frameworks.

Monitor the Privacy by Design and Privacy by Default into the SDLC and data engineering practices.

Review DPAs, data sharing agreements, and privacy clauses in vendor contracts.

Data Subject Rights & Incident Management

Manage data subject requests — access, correction, erasure, portability, and grievance redressal — within regulatory timelines.

Lead the data breach response: detection, containment, regulatory notification, and post-incident review.

Cyber Security Strategy & Governance

Establish cybersecurity policies, standards, and guidelines based on industry best practices and regulatory frameworks (ISO 27001).

Collaborate with HR and the compliance team to build a cybersecurity-aware culture through regular training and education programmes.

Lead risk assessments to identify potential security threats and vulnerabilities, and propose effective mitigation measures.

Develop and maintain an incident response programme, managing cybersecurity incidents and data breaches from detection to remediation.

Requirements

3+ years of experience in information security, data privacy, or a combined role, preferably in fintech, insurtech, BFSI, or a regulated industry.

Knowledge of India's DPDP Act 2023 and hands-on experience implementing data protection programmes.

Strong working knowledge of ISO 27001.

Proven experience managing security incidents, data breaches, and regulatory notifications.

Excellent communication skills — able to translate complex security and legal concepts for non-technical stakeholders.

Technical degree (B.Tech/M.Tech in CS/IT or MBA in Information Security, or related field).