Manager- Security & Compliance

Role & responsibilities

• Design, implement, and maintain the enterprise Information Security Management System (ISMS) aligned with ISO 27001 standards, driving the organisation toward certification readiness.
• Own the compliance roadmap across all applicable frameworks SEBI CSCRF, DPDP Act 2023, CERT-In incident reporting directives, ITGC/ICFR controls, and PCI DSS for payment environments.
• Conduct periodic risk assessments, vulnerability analyses, and control gap evaluations across IT infrastructure, applications, and third-party integrations.
• Coordinate and manage VAPT (Vulnerability Assessment & Penetration Testing) cycles across web, mobile, and API surfaces, tracking remediation to closure.
• Develop and enforce IT security policies, access control frameworks, data classification standards, and incident response procedures.
• Serve as the primary point of contact for internal auditors, statutory auditors, and regulatory bodies on all IT security and compliance matters.
• Drive security awareness training programmes across the organisation to build a culture of compliance and vigilance.
• Monitor and respond to security incidents, ensuring adherence to CERT-In reporting timelines and internal escalation protocols.
• Maintain audit-ready documentation policy registers, control evidence, risk treatment plans, and compliance dashboards for board and audit committee review.
• Evaluate and manage third-party/vendor security risk, ensuring SLA and contractual compliance with data protection obligations.

Preferred candidate profile

• Graduate in any discipline; a Master's degree in Information Security, IT, or Management will be preferred.
• 7+ years of experience in information security, IT risk management, or IT compliance preferably in a listed company, BFSI, or organised retail environment.
• CISA certification required; ISO 27001 Lead Auditor / Lead Implementer certification required. Additional certifications (CISSP, CRISC, CEH) are a strong advantage.
• In-depth knowledge of Indian regulatory frameworks like SEBI CSCRF, DPDP Act, CERT-In directives, and ITGC/ICFR controls.
• Hands-on experience with VAPT coordination, security audits, and remediation tracking.
• Familiarity with PCI DSS compliance requirements for retail payment environments.
• Strong documentation and reporting skills ability to present security posture and compliance status to board-level stakeholders.
• Excellent stakeholder management skills across IT, business, legal, and external audit teams.