Security & Compliance Lead

Nuvena; New Delhi; On-site; INR 1,800,000 - 3,200,000; Full time

Job summary

Nuvena is seeking a security and compliance leader to own security for Navio OS, Navio On It, and customer deployments. You will drive VAPT programs, manage audits, maintain policies, and ensure DPDP Act compliance across India and global standards.

You will coordinate with teams on security controls, incident response, and secure development practices while staying ahead of evolving regulations and industry requirements. This role requires hands-on technical leadership and clear communication.

Qualifications

• 4–5 years in cybersecurity with hands-on VAPT of web apps, APIs and mobile apps.
• Implemented ISO27001 or SOC 2 end-to-end.
• Knowledge of DPDP Act or data protection laws.
• Cloud/Linux security on AWS/Azure; containers and CI/CD.
• Clear writing for policies, audit reports and customer responses.

Responsibilities

• Secure Nuvena products and infrastructure (cloud, Linux, containers).
• Lead VAPT on web/mobile apps and manage external audits; track findings to closure.
• Maintain audit logs, evidence and sign-offs for customers/regulators.
• Ensure compliance with DPDP Act and related rules; act as privacy contact.
• Lead ISO/IEC 27001/27701 and SOC 2 when needed.
• Write and maintain security policies (access control, incident response, DR).
• Meet CERT-In directions (incident reporting, log retention).
• Train team on secure coding and review security of code/architecture.

Skills

Cybersecurity

VAPT of web apps & APIs

Cloud security (AWS/Azure)

Linux security

Container security / CI/CD

Security policy writing

Security training/mentoring

Tools

Burp Suite

OWASP ZAP

Nmap

Job description

About Nuvena: Nuvena builds Navio, the Execution Operating System: every promise a company makes or is owed — in a contract or to a team — gets an owner, a follow-up and proof.

Own security and compliance for every Nuvena product and customer deployment: VAPT, audits, ISO 27001 and the DPDP Act.

New Delhi · 4–5 years

Role Summary

You own security and compliance for everything Nuvena builds and runs: Navio OS, Navio On It, our internal systems and the deployments at our customers. You keep our products secure, our policies current and our audits clean, in line with India's Digital Personal Data Protection Act and global security standards.

Key Responsibilities

• Secure all our products and infrastructure (AWS, Azure, Linux, Docker): hardening, access control, secrets, logging, monitoring and backups.
• Run VAPT on our web apps, mobile apps and APIs every release, and manage external audits by CERT-In empanelled auditors; track every finding to closure.
• Keep a complete audit log of findings, fixes, evidence and sign-offs, ready for any customer or regulator.
• Own compliance with the DPDP Act 2023 and the DPDP Rules: data map, consent and notices, retention and deletion, data-principal requests and breach handling; act as our privacy and grievance contact.
• Lead ISO/IEC 27001 (and 27701) from gap assessment to certification, and SOC 2 when customers need it.
• Write and maintain our security policies: access, incident response, BCP/DR, vendor risk and secure development.
• Meet the CERT-In Directions: incident reporting within 6 hours, 180-day log retention and clock synchronisation.
• Maintain security at customer deployments: patching, periodic VAPT, customer security questionnaires and audits.
• Track new laws and standards, including RBI, SEBI and IRDAI guidelines for our banking and insurance customers, and keep our controls current.
• Train the team on secure coding, and review code and architecture for security.

Must Have

• 4–5 years in cybersecurity, with hands‑on VAPT of web apps, APIs and mobile apps (Burp Suite, OWASP ZAP, Nmap, OWASP Top 10, MASVS).
• Has implemented ISO 27001 controls or a SOC 2 programme end to end.
• Working knowledge of the DPDP Act and the CERT-In Directions.
• Cloud and Linux security on AWS or Azure; containers and CI/CD.
• Clear writing: policies, audit reports and customer security responses.

Good To Have

• OSCP, CEH, ISO 27001 Lead Auditor or Implementer, CISA, CISM or CompTIA Security+.
• BFSI security frameworks (RBI, SEBI CSCRF, IRDAI) or government audits (CERT‑In empanelled, STQC, MeitY).
• GDPR, or the UAE or Saudi personal data protection laws, for international customers.
• SIEM and EDR tools, threat modelling and a secure SDLC.

What we expect from everyone:

• Go‑getter
• Problem‑solver
• Open‑mind
• Takes decisions
• Owns the outcome
• Works as one team