Senior Manager - Information Security

SarvaGram Fincare Private Limited; Pune District; On-site; INR 4,000,000 - 6,000,000; Full time

Job summary

SarvaGram is seeking a Senior Manager - Information Security to own security strategy, audit readiness, and technical posture for a fast-growing fintech in rural India. The role is hands-on and build-from-ground-up, reporting to the CTPO and based in Baner, Pune with work-from-office mode.

You will drive enterprise security across AWS, applications, APIs, and mobile ecosystems, while aligning with RBI IT governance, DPDP Act 2023, and other regulatory requirements.

Qualifications

• Define and own enterprise information security strategy aligned to RBI, DPDP, and other guidelines.
• Build and mature security posture across AWS, applications, APIs, and field-force devices.
• Own end-to-end audit lifecycle: VAPT, internal/external audits, CERT‑In engagements.
• Develop GRC artefacts: risk registers, BCP/DR, data localisation tracking.
• Embed security-by-design in SDLC and release governance.

Responsibilities

• Define and own enterprise information security strategy and roadmap, aligned to business growth and regulatory expectations (RBI IT Governance & Risk Controls, Digital Lending Guidelines, DPDP Act 2023).
• Build and mature the organisation's security posture across cloud infrastructure (AWS), applications, APIs, and the field-force mobile ecosystem.
• Own the end-to-end audit management lifecycle: VAPT (Server, API, Application), internal and external ISaudits, CERT‑In empanelled engagements, evidence collection, and remediation tracking.
• Build and operationalise GRC artefacts: risk registers, Information Asset Register, BCP/DR documentation, and data localisation tracking.
• Partner with engineering squads to embed security-by-design into the SDLC and release governance process (change management, CAB/PIR).
• Drive DPDP Act compliance: consent architecture, breach‑notification readiness, and vendor data processing agreement (DPA) due diligence.
• Provide hands‑on technical leadership - security architecture reviews, threat modelling, and incident response - rather than operating purely at a policy level.
• Represent the security function credibly in front of auditors, regulators, and senior leadership as required.

Skills

Information security strategy

Regulatory compliance

Cloud security (AWS)

Audit management

Threat modelling

Incident response

Security architecture

Stakeholder communication

Job description

SarvaGram is building India’s first household centric, data led ‘high-tech high-touch’ FinTech platform to meet the growing aspirations of rural India, with a bouquet of financial and productivity enhancing offerings.

We achieve this by offering a suite of customized financial and capacity-building products designed to meet the unique requirements of rural households.

From loans and insurance solutions to innovative services like Farming-as-a-Service (FaaS), we equip rural communities with the tools they need to prosper.

Job Description

About the Role

SarvaGram is building out its information security leadership bench as the organisation scales. We are looking for a Senior Manager - Information Security who combines genuine technical depth with regulatory fluency specific to the lending/NBFC domain. This is a hands‑on, build-from-the-ground‑up role - not a steady‑state operator position - for someone who wants to own security strategy, audit readiness, and technical posture for a fast‑growing regulated fintech.

Reports to: Chief Technology & Product Officer (CTPO)

Location: Baner, Pune

Mode: Work from Office

Experience: 8-12 years

Requirements

• Define and own enterprise information security strategy and roadmap, aligned to business growth andregulatory expectations (RBI IT Governance & Risk Controls, Digital Lending Guidelines, DPDP Act 2023).
• Build and mature the organisation's security posture across cloud infrastructure (AWS), applications, APIs,and the field-force mobile ecosystem.
• Own the end-to-end audit management lifecycle: VAPT (Server, API, Application), internal and external ISaudits, CERT‑In empanelled engagements, evidence collection, and remediation tracking.
• Build and operationalise GRC artefacts: risk registers, Information Asset Register, BCP/DR documentation,and data localisation tracking.
• Partner with engineering squads to embed security-by-design into the SDLC and release governance process (change management, CAB/PIR).
• Drive DPDP Act compliance: consent architecture, breach‑notification readiness, and vendor dataprocessing agreement (DPA) due diligence.
• Provide hands‑on technical leadership - security architecture reviews, threat modelling, and incidentresponse - rather than operating purely at a policy level.
• Represent the security function credibly in front of auditors, regulators, and senior leadership as required.

Key Responsibilities

• Define and own enterprise information security strategy and roadmap, aligned to business growth andregulatory expectations (RBI IT Governance & Risk Controls, Digital Lending Guidelines, DPDP Act 2023).
• Build and mature the organisation's security posture across cloud infrastructure (AWS), applications, APIs,and the field-force mobile ecosystem.
• Own the end-to-end audit management lifecycle: VAPT (Server, API, Application), internal and external ISaudits, CERT‑In empanelled engagements, evidence collection, and remediation tracking.
• Build and operationalise GRC artefacts: risk registers, Information Asset Register, BCP/DR documentation,and data localisation tracking.
• Partner with engineering squads to embed security‑by‑design into the SDLC and release governance process (change management, CAB/PIR).
• Drive DPDP Act compliance: consent architecture, breach‑notification readiness, and vendor dataprocessing agreement (DPA) due diligence.
• Provide hands‑on technical leadership - security architecture reviews, threat modelling, and incidentresponse - rather than operating purely at a policy level.
• Represent the security function credibly in front of auditors, regulators, and senior leadership as required.

What We're Looking For

• 8+ years in information security, with demonstrable exposure to BFSI/NBFC/fintech regulatory requirements(RBI, DPDP, IT Act).
• A track record of building or substantially maturing a security program - not only operating controlssomeone else designed.
• Working knowledge of ISO 27001, NIST, VAPT lifecycles, and CERT‑In requirements.
• Genuine hands‑on technical depth across cloud security (AWS preferred), application security, andnetwork/infrastructure security.
• Strong communication skills - comfortable translating technical risk into business and regulatory languagefor senior stakeholders.
• Prior exposure to digital lending or similar regulated consumer-lending businesses is a strong plus

SarvaGram is on a mission to revolutionize financial services for millions in rural India. We're building the nation's first data-driven platform that combines cutting‑edge technology with a human touch to unlock financial possibilities for underserved households.

This is your chance to be at the forefront of innovation. Join us and:

• Shape the future of FinTech: We're not just building a product, we're creating a new category. Be a part of defining the future of financial inclusion for rural India.
• Embrace a high‑growth, high‑impact environment: This is a non‑linear growth opportunity. Build a platform used by millions and witness the network effect drive massive scale.
• Tackle real‑world challenges: Apply your skills to solve critical problems and directly empower rural communities.
• Craft solutions that touch lives: Develop innovative products used by diverse household members, each with unique needs