Information Security Officer

About the role

The Information Security Officer will lead the organisation's security governance, risk management and compliance programmes. You will work closely with technology, DevOps, compliance, HR and business teams to ensure audit readiness and mitigate security risks.

Key responsibilities

• Own and drive information security governance, risk management, compliance and audit readiness.
• Manage audit and compliance calendars, including bank audits, regulatory reviews, partner reviews and security questionnaires.
• Maintain readiness for ISO 27001, PCI DSS, RBI Cyber Security Framework, Digital Lending Guidelines, DPDP/data privacy and other applicable standards.
• Develop and maintain policies, procedures, risk registers, audit evidence, compliance trackers and closure reports.
• Coordinate internal reviews for access control, privileged access, vendor security, cloud security and security configurations.
• Lead VAPT, source‑code reviews, cloud security reviews, SAST/DAST activities and remediation tracking.
• Collaborate with cross‑functional teams to close vulnerabilities, audit findings and security incidents.
• Own security incident response execution, including escalation, root‑cause analysis, corrective actions and periodic drills.

Required profile

• 3‑5 years of experience in information security, GRC, IT risk, cybersecurity coordination, audit or compliance.
• Hands‑on experience with bank and regulatory audits, ISO 27001, PCI DSS, VAPT coordination and risk registers.
• Background in fintech, banking, NBFC, payments or other regulated technology environments is preferred.
• Bachelor’s degree in Computer Science, IT, Information Security or related field.
• Relevant certifications such as ISO 27001 LA/LI, CISA, CISM, PCI DSS, ISO 27701, Security+ or CEH are a plus.

Required skills

• ISO 27001
• PCI DSS
• RBI Cyber Security Framework
• Digital Lending Guidelines
• VAPT (Vulnerability Assessment & Penetration Testing)
• SAST / DAST
• Cloud security
• API security
• Application security
• Identity & Access Management (IAM)
• Vulnerability management
• Incident response
• Secure SDLC
• Vendor security assessment