Senior Security Manager

Disprz; Chennai District; On-site; INR 4,000,000 - 9,000,000; Full time

Job summary

Disprz is seeking a senior security leader to architect and run the company’s information security program across enterprise and product areas. You will own strategy, governance, risk management, and cadence with leadership, engineering, and product teams to balance security with business enablement.

The role covers cloud security, incident response and customer security assurance, requiring collaboration with Legal, Compliance, HR, Sales and Success teams across a fast-growing SaaS environment.

Qualifications

• 10–18+ years of information security/cybersecurity leadership experience.
• Experience building and maturing enterprise security programs for SaaS/technology products.
• Familiarity with ISO 27001, SOC 2 Type II and data privacy regulations (GDPR/DPDP).

Responsibilities

• Define and execute multi-year information security strategy aligned with business and product goals.
• Own product security, cloud security, risk management, compliance and incident response.
• Lead security governance, audits, third-party risk, and customer security assurance.

Skills

Information security leadership

Cloud security

DevSecOps

Security governance

Incident response

Education

CISSP / CISM / CCSP

Bachelor’s or Master’s in CS/IT

Tools

ISO 27001

SOC 2 Type II

DPDP / GDPR

Job description

Senior Security Manager / Director – Information Security

Function:

Information Security / Cybersecurity

Reporting to

CTO / COO

Experience:

10–18+ years

Industry:

SaaS / Enterprise Software / Technology Products

Role Overview

We are looking for a seasoned Information Security leader to build, operate and continuously mature the company's enterprise and product security programme. The individual will perform the responsibilities of a CISO, with ownership across information

security strategy, product security, cloud security, cybersecurity risk, compliance, privacy collaboration, security governance, incident response and customer security assurance. This is a highly visible leadership role requiring close partnership with the Engineering, Product, Cloud/Infrastructure, Legal, Compliance, HR, Sales and Customer Success teams. The successful candidate will be expected to balance security, business enablement and customer trust, rather than treating security purely as a compliance or IT function.

Key Responsibilities

1. Information Security Strategy & Governance

• Define and execute the company's multi-year Information Security and Cybersecurity strategy aligned with business and product objectives.
• Establish and maintain the enterprise Information Security Management System (ISMS).
• Develop security policies, standards, procedures and control frameworks.
• Establish security governance, metrics, KRIs/KPIs and executive reporting.
• Present security posture, material risks, incidents and remediation progress to the executive leadership team and, where required, the Board.
• Maintain an enterprise-wide cybersecurity risk register and drive remediation of material risks.
• Define security architecture and technology principles in partnership with Engineering and IT.

2. Product & Application Security

• Own the Product Security portfolio covering the SaaS platform, web applications, APIs, mobile applications and supporting services.
• Embed security into the SDLC and DevSecOps lifecycle.
• Establish application-security standards covering secure coding, threat modelling, SAST,
• DAST, SCA, API security, secrets management and vulnerability management.
• Establish appropriate penetration testing and application security assessment programmes.
• Partner with Engineering to ensure security vulnerabilities are prioritised and remediated based on business risk.
• Drive security-by-design for new products, features, integrations and architectural changes.
• Establish and maintain Software Supply Chain Security / SBOM practices.
• Own the security posture of the company's cloud environments and supporting infrastructure.
• Establish cloud security standards covering IAM, network security, encryption, logging, configuration management, workload security and data protection.
• Partner with Cloud/DevOps teams to implement Cloud Security Posture Management and secure infrastructure-as-code practices.
• Ensure appropriate segregation of production, non-production and customer environments.
• Review and approve security aspects of major infrastructure and architectural changes.

4. Security Operations & Incident Response

• Establish and oversee the company's cybersecurity monitoring and detection capabilities.
• Define and maintain an enterprise Incident Response and Cyber Crisis Management framework.
• Lead or coordinate response to significant security incidents, data breaches and cyber events.
• Establish incident severity, escalation and communication protocols.
• Conduct post-incident reviews and ensure corrective actions are implemented.
• Maintain relationships with relevant external security partners, incident-response providers and law-enforcement/regulatory bodies where appropriate.

5. Vulnerability & Risk Management

• Establish an enterprise-wide vulnerability management programme.
• Define risk-based remediation SLAs and exception-management processes.
• Oversee vulnerability identification across applications, infrastructure, cloud environments
• and third-party components.
• Drive periodic security assessments, penetration testing and risk reviews.
• Ensure security risks are tracked through to closure.

6. Compliance & Certifications

• Own and continuously mature the company's security compliance programme, including relevant
• frameworks and standards such as:
• ISO 27001
• SOC 2 Type II
• ISO 42001
• India DPDP Act and related requirements
• Customer specific security and regulatory requirements
• Other industry specific frameworks applicable to the company's markets
• Lead internal and external security audits.
• Ensure audit findings are appropriately remediated.
• 21 CFR Part 11 / EU GMP Annex 11 compliance
• Maintain evidence, control ownership and audit readiness throughout the year rather than only during audit periods.

7. Customer Security & Trust

• Own the security component of customer due diligence and enterprise security assessments.
• Partner with Sales, Pre-Sales and Customer Success on security questionnaires, RFPs and customer audits.
• Develop standard security responses, trust documentation and evidence repositories.
• Participate in strategic customer meetings involving cybersecurity, privacy, compliance and risk.
• Establish a scalable mechanism for responding to customer security requirements without creating unnecessary engineering overhead.
• Support the development and maintenance of customer-facing security/trust documentation.
• Partner closely with the DPO / Legal / Privacy function on information-security aspects of privacy compliance.
• Support DPIAs, data-processing assessments and privacy-by-design initiatives.
• Ensure security controls support applicable data retention, deletion, access and breach- notification requirements.

9. Business Continuity & Resilience

• Own cybersecurity aspects of Business Continuity and Disaster Recovery.
• Establish recovery objectives and security requirements for critical SaaS services.
• Conduct periodic DR, cyber-resilience and crisis simulations.
• Ensure backup, recovery and resilience controls are appropriately protected against cyber threats such as ransomware.
• Partner with Engineering/Infrastructure teams to validate recovery capability.

10. Third-Party & Supply-Chain Security

• Establish a risk-based Third-Party Risk Management programme.
• Assess security posture of critical vendors, SaaS providers, cloud providers and technology partners.
• Define security requirements for vendor onboarding and contracting.
• Conduct periodic reassessment of critical suppliers.
• Establish appropriate security clauses, audit rights and breach-notification requirements in collaboration with Legal.

11. Security Awareness & Culture

• Establish an organisation-wide security awareness programme.
• Conduct phishing simulations, secure-development training and role-specific security raining.
• Build a culture where security is considered a shared responsibility across Engineering,
• Product, IT and business teams.
• Establish security champions within engineering/product teams.
• Establish security governance for the company's adoption of Generative AI, AI agents, LLMs and other emerging technologies.
• Assess risks associated with AI-enabled product features and internal AI usage.
• Define controls for data leakage, model access, prompt injection, supply-chain risks and inappropriate use of sensitive information.
• Partner with Product, Engineering, Legal and Privacy teams on responsible and secure AI adoption.

Candidate Profile

• 10–18+ years of experience in Information Security / Cybersecurity.
• Significant experience in a SaaS, cloud, technology product or enterprise software environment.
• Demonstrated ownership of an enterprise-wide security programme.
• Strong understanding of both Product Security and Enterprise Information Security.
• Experience with ISO 27001, SOC 2 and GDPR.
• Strong understanding of cloud security, preferably across AWS and/or Azure.
• Strong application-security and DevSecOps understanding.
• Experience managing security incidents and cyber-risk programmes.
• Experience interacting with enterprise customers on security assessments.
• Strong understanding of security governance, risk and compliance.
• Demonstrated ability to influence senior Engineering, Product and Business leaders.
• Exposure to AI security / AI governance.

Preferred

• CISSP / CISM / CCSP / CRISC or equivalent.
• Experience taking a SaaS company through SOC 2 / ISO 27001 certification and subsequent maturation.
• Experience with GDPR / DPDP and international privacy requirements.
• Experience with enterprise customer security audits.
• Experience with security architecture and threat modelling.
• Experience with SBOM / software supply-chain security.
• Prior experience as CISO, Deputy CISO, Head of Information Security, Director – Information
• Security or Associate Director – Information Security.