Information Security Lead

About the role

RoboMQ is seeking an Information Security Lead to drive security initiatives across its SaaS Identity Governance platform. You will champion a zero‑trust, least‑privilege security posture and work closely with engineering, operations, and leadership teams.

Key responsibilities

• Lead Application Security (AppSec) by integrating SAST and DAST into the CI/CD pipeline, conducting threat modeling and secure code reviews.
• Own the end‑to‑end vulnerability management lifecycle, design risk assessment methodologies, and ensure systematic patching of applications and infrastructure.
• Perform hands‑on security assessments using tools such as Nmap and OWASP ZAP, and produce actionable remediation plans.
• Secure cloud‑native infrastructure on AWS, overseeing firewalls, micro‑segmentation, IDS/IPS, and Web Application Firewalls.
• Implement and maintain security controls aligned with SOC 2, HIPAA, and other regulatory frameworks.
• Develop, publish, and enforce enterprise‑wide security policies, standards, and procedures.
• Manage third‑party risk by designing assessment frameworks for SaaS integrations and supply‑chain vendors.
• Lead incident response efforts, coordinating engineering, DevOps, and leadership to mitigate and resolve security events.

Required profile

• 5+ years of experience in Cyber Security, Information Security, or Application Security.
• Proven track record of leading security initiatives across engineering, operations, and infrastructure.
• Technical degree (B.Tech/B.E.) from a premier engineering institute.
• Deep architectural understanding of network security, cloud ecosystems, and modern attack surfaces.
• Strong stakeholder management, communication, and leadership abilities.
• Ownership mindset to foster a culture of zero‑trust security.

Required skills

• SAST and DAST tools integration
• Threat modeling and secure code review
• Nmap
• OWASP ZAP (or equivalent commercial tools)
• AWS cloud security
• Firewalls, micro‑segmentation, IDS/IPS, WAF
• SOC 2 compliance
• HIPAA compliance
• Third‑party risk assessment frameworks
• Incident response and root‑cause analysis