Senior Security Manager

Senior Security Manager / Director – Information Security Location: Chennai Function: Information Security / Cybersecurity Reporting to: CTO / COO Experience: 10–18 + years Industry: SaaS / Enterprise Software / Technology Products Role Overview We are looking for a seasoned Information Security leader to build, operate and continuously mature the company's enterprise and product security programme. The individual will perform the responsibilities of a CISO, with ownership across informationsecurity strategy, product security, cloud security, cybersecurity risk, compliance, privacy collaboration, security governance, incident response and customer security assurance. This is a highly visible leadership role requiring close partnership with the Engineering, Product, Cloud/Infrastructure, Legal, Compliance, HR, Sales and Customer Success teams. The successful candidate will be expected to balance security, business enablement and customer trust, rather than treating security purely as a compliance or IT function.

Key Responsibilities

1. Information Security Strategy & Governance

• Define and execute the company's multi‐year Information Security and Cybersecurity strategy aligned with business and product objectives.
• Establish and maintain the enterprise Information Security Management System (ISMS).
• Develop security policies, standards, procedures and control frameworks.
• Establish security governance, metrics, KRIs/KPIs and executive reporting.
• Present security posture, material risks, incidents and remediation progress to the executive leadership team and, where required, the Board.
• Maintain an enterprise‐wide cybersecurity risk register and drive remediation of material risks.
• Define security architecture and technology principles in partnership with Engineering and IT.

2. Product & Application Security

• Own the Product Security portfolio covering the SaaS platform, web applications, APIs, mobile applications and supporting services.
• Embed security into the SDLC and DevSecOps lifecycle.
• Establish application‐security standards covering secure coding, threat modelling, SAST, DAST, SCA, API security, secrets management and vulnerability management.
• Establish appropriate penetration testing and application security assessment programmes.
• Partner with Engineering to ensure security vulnerabilities are prioritised and remediated based on business risk.
• Drive security‐by‐design for new products, features, integrations and architectural changes.
• Establish and maintain Software Supply Chain Security / SBOM practices.

3. Cloud & Infrastructure Security

• Own the security posture of the company's cloud environments and supporting infrastructure.
• Establish cloud security standards covering IAM, network security, encryption, logging, configuration management, workload security and data protection.
• Partner with Cloud/DevOps teams to implement Cloud Security Posture Management and secure infrastructure‐as‐code practices.
• Ensure appropriate segregation of production, non‐production and customer environments.
• Review and approve security aspects of major infrastructure and architectural changes.

4. Security Operations & Incident Response

• Establish and oversee the company's cybersecurity monitoring and detection capabilities.
• Define and maintain an enterprise Incident Response and Cyber Crisis Management framework.
• Lead or coordinate response to significant security incidents, data breaches and cyber events.
• Establish incident severity, escalation and communication protocols.
• Conduct post‐incident reviews and ensure corrective actions are implemented.
• Maintain relationships with relevant external security partners, incident‐response providers and law‐enforcement/regulatory bodies where appropriate.

5. Vulnerability & Risk Management

• Establish an enterprise‐wide vulnerability management programme.
• Define risk‐based remediation SLAs and exception‐management processes.
• Oversee vulnerability identification across applications, infrastructure, cloud environments and third‐party components.
• Drive periodic security assessments, penetration testing and risk reviews.
• Ensure security risks are tracked through to closure.

6. Compliance & Certifications

• Own and continuously mature the company's security compliance programme, including relevant frameworks and standards such as:
• ISO 27001
• SOC 2 Type II
• ISO 42001
• GDPR / applicable data‐protection regulations
• India DPDP Act and related requirements
• Customer specific security and regulatory requirements
• Other industry specific frameworks applicable to the company's markets
• Lead internal and external security audits.
• Ensure audit findings are appropriately remediated.
• 21 CFR Part 11 / EU GMP Annex 11 compliance
• Maintain evidence, control ownership and audit readiness throughout the year rather than only during audit periods.

7. Customer Security & Trust

• Own the security component of customer due diligence and enterprise security assessments.
• Partner with Sales, Pre‐Sales and Customer Success on security questionnaires, RFPs and customer audits.
• Develop standard security responses, trust documentation and evidence repositories.
• Participate in strategic customer meetings involving cybersecurity, privacy, compliance and risk.

8. Data Protection & Privacy Collaboration

• Partner closely with the DPO / Legal / Privacy function on information‐security aspects of privacy compliance.
• Support DPIAs, data‐processing assessments and privacy‐by‐design initiatives.
• Ensure security controls support applicable data retention, deletion, access and breach‐notification requirements.

9. Business Continuity & Resilience

• Own cybersecurity aspects of Business Continuity and Disaster Recovery.
• Establish recovery objectives and security requirements for critical SaaS services.
• Conduct periodic DR, cyber‐resilience and crisis simulations.
• Ensure backup, recovery and resilience controls are appropriately protected against cyber threats such as ransomware.
• Partner with Engineering/Infrastructure teams to validate recovery capability.

10. Third‐Party & Supply‐Chain Security

• Establish a risk‐based Third‐Party Risk Management programme.
• Assess security posture of critical vendors, SaaS providers, cloud providers and technology partners.
• Define security requirements for vendor onboarding and contracting.
• Conduct periodic reassessment of critical suppliers.
• Establish appropriate security clauses, audit rights and breach‐notification requirements in collaboration with Legal.

11. Security Awareness & Culture

• Establish an organisation‐wide security awareness programme.
• Conduct phishing simulations, secure‐development training and role‐specific security raining.
• Build a culture where security is considered a shared responsibility across Engineering, Product, IT and business teams.
• Establish security champions within engineering/product teams.

12. Emerging Technology & AI Security

• Establish security governance for the company's adoption of Generative AI, AI agents, LLMs and other emerging technologies.
• Assess risks associated with AI‐enabled product features and internal AI usage.
• Define controls for data leakage, model access, prompt injection, supply‐chain risks and inappropriate use of sensitive information.
• Partner with Product, Engineering, Legal and Privacy teams on responsible and secure AI adoption.

• 10–18 + years of experience in Information Security / Cybersecurity.
• Significant experience in a SaaS, cloud, technology product or enterprise software environment.
• Demonstrated ownership of an enterprise‐wide security programme.
• Strong understanding of both Product Security and Enterprise Information Security.
• Experience with ISO 27001, SOC 2 and GDPR.
• Strong understanding of cloud security, preferably across AWS and/or Azure.
• Strong application‐security and DevSecOps understanding.
• Experience managing security incidents and cyber‐risk programmes.
• Experience interacting with enterprise customers on security assessments.
• Strong understanding of security governance, risk and compliance.
• Demonstrated ability to influence senior Engineering, Product and Business leaders.
• Exposure to AI security / AI governance.