Chief Information Security Officer

About the role

The Chief Information Security Officer will partner with the Group CISO and the Country Manager for India to design, implement and oversee the bank’s information security policies and compliance programs across Indian operations. This senior leader will ensure alignment with RBI regulations and drive the full lifecycle of the Information Security Management System (ISMS) and related security initiatives.

Key responsibilities

• Lead the cyber‑security governance framework and all related activities as directed by the Group CISO.
• Develop annual strategies, policies and procedures for the Information Security function, ensuring they support business objectives.
• Manage the ISMS, security operations centre (SOC), vulnerability assessment and penetration testing (VAPT), red‑team exercises, and RBI Daksh portal submissions.
• Coordinate incident response, access‑control, business continuity and disaster‑recovery activities.
• Prepare and present progress reports to senior management and regulatory bodies such as RBI, IBA, IDRBT, CERT‑In and CSITE.
• Maintain compliance with ISO 27001 and the RBI Cyber Security Framework, including performance monitoring checklists.
• Represent information security risks and remediation measures on the India Management Committee and Risk Management Committee.

Required profile

• Master’s degree in Computer Science, IT, Electronics & Telecommunications, Electrical/Electronics Engineering or MCA.
• Professional certifications such as CISSP, CISM, CISA or ISO 27001 lead auditor are preferred.
• Extensive experience in information security governance, risk management and regulatory compliance within the banking sector.

Required skills

• ISO 27001 implementation and audit
• RBI Cyber Security Framework
• Information Security Management System (ISMS)
• Vulnerability Assessment and Penetration Testing (VAPT)
• Red‑team testing
• Security Operations Centre (SOC) management
• Incident response and handling
• Access‑control mechanisms
• Business continuity and disaster‑recovery planning