Lead-Information Security & Data Protection

Riskcovry; Bengaluru; On-site; INR 4,000,000 - 6,000,000; Full time

Job summary

Riskcovry is seeking a Lead-Information Security & Data Protection to oversee privacy, security governance, and incident response in Bangalore. You will drive regulatory compliance, implement DPDP Act 2023 requirements, and coordinate across HR and compliance to build a security-aware culture.

The role requires hands-on experience with data protection programmes, risk assessments, and incident management, with a focus on fintech/privacy-regulated contexts in India.

Qualifications

• 3+ years of experience in information security or data privacy.
• Hands-on experience implementing data protection programmes.
• Strong knowledge of ISO 27001 and privacy regulations (DPDP Act 2023).

Responsibilities

• Act as the designated DPO under India’s DPDP Act 2023 and other privacy laws.
• Maintain a data processing inventory with a documented lawful basis.
• Support privacy policies, retention schedules, and consent frameworks.
• Lead the data breach response including detection, containment, notification, and post-incident review.
• Develop cybersecurity policies and guidelines based on best practices and regulatory frameworks (ISO 27001).

Skills

Information security

Data privacy

DPDP Act 2023

ISO 27001

Regulatory compliance

Stakeholder communication

Education

B.Tech/M.Tech in CS/IT or MBA in Information Security

Job description

Job Summary

Lead-Information Security & Data Protection

Location

Bangalore, Karnataka, India

Job Type

Full time

Responsibilities

Regulatory Compliance & Governance

• Act as the designated DPO under Indias DPDP Act 2023 and other applicable privacy laws.
• Maintain a data processing inventory with a documented lawful basis for all activities under the DPDPA Act 2023.
• Support the development and maintenance of privacy policies, data retention schedules, and consent management frameworks.
• Monitor the Privacy by Design and Privacy by Default into the SDLC and data engineering practices.
• Review DPAs, data sharing agreements, and privacy clauses in vendor contracts.

Data Subject Rights & Incident Management

• Manage data subject requests access, correction, erasure, portability, and grievance redressal within regulatory timelines.
• Lead the data breach response: detection, containment, regulatory notification, and post-incident review.

Cyber Security Strategy & Governance

• Establish cybersecurity policies, standards, and guidelines based on industry best practices and regulatory frameworks (ISO 27001).
• Collaborate with HR and the compliance team to build a cybersecurity-aware culture through regular training and education programmes.
• Lead risk assessments to identify potential security threats and vulnerabilities, and propose effective mitigation measures.
• Develop and maintain an incident response programme, managing cybersecurity incidents and data breaches from detection to remediation.

Requirements

• 3+ years of experience in information security, data privacy, or a combined role, preferably in fintech, insurtech, BFSI, or a regulated industry.
• Knowledge of Indias DPDP Act 2023 and hands-on experience implementing data protection programmes.
• Strong working knowledge of ISO 27001.
• Proven experience managing security incidents, data breaches, and regulatory notifications.
• Excellent communication skills able to translate complex security and legal concepts for non-technical stakeholders.
• Technical degree (B.Tech/M.Tech in CS/IT or MBA in Information Security, or related field).