Information Security Associate

As a member of the Information Security Team at Glomopay, you will own the entire information security

function — from policy and governance to hands-on implementation and regulatory compliance. Reporting

directly to the Head of Information Security, this is a strategic role for a security practitioner who can single-handedly stand up a mature InfoSec program for Glomo

Key Responsibilities

Security Governance & Compliance

• Own the Information Security Management System (ISMS) — policy framework, risk assessments and control implementation aligned with ISO 27001, PCI DSS, and IFSCA Cyber Security and

• Cyber Resilience Framework

• Lead compliance with RBI outsourcing directions, IFSCA circulars, DPSC guidelines, and PCI SSF requirements applicable to payment service providers

• Own third-party risk management — conduct due diligence audits on all technology partners and maintain records per regulatory requirements

• Drive the internal IT audit program — plan, execute, engage external audit vendors, and track findings to closure

• Establish the Information Classification framework, embedding it into DLP rules, employee training, and daily operations

Security Operations & Architecture (Hands-On)

• Build and manage the SOC function — starting with MDR-augmented operations (CrowdStrike), progressively maturing toward hybrid capability

• Own the SIEM strategy: integrate and monitor all critical log sources (application, infrastructure, database, identity, PAM) and build detection use-cases

• Conduct threat modelling Manage Privileged Access Management (PAM) — session monitoring, password rotation,break-glass procedures, periodic user access reviews

• Implement and manage DLP controls across endpoints, email, and cloud storage (Google Workspace DLP, CrowdStrike Device Control)

• Own endpoint security — hardening SOPs against CIS benchmarks, approved software lists, full disk encryption

• Drive network security posture — geo-fencing, firewall rule reviews, Cloud IDS tuning across GCP infrastructure

• Oversee application security — integrate SAST/DAST into CI/CD pipelines, define security review thresholds, manage OWASP compliance

Incident Management & Business Continuity

• Own the incident management lifecycle — severity classifications, closure SLAs, escalation

• procedures, post-incident reviews

• Establish a dedicated security incident reporting channel and ensure organization-wide awareness

• Maintain and test the Business Continuity Plan covering office unavailability, power failure,

• pandemic, and cloud provider disruption scenarios

• Ensure DR drills meet RTO thresholds with proper segregation of duties

• Serve as the primary point of contact during security incidents, coordinating response with banking partners and regulators per notification SLAs

Regulatory & Partner Interface

• Serve as the primary security interface with banking partners, managing their Third Party Service provider Risk Assessments

• Build the “Managed Security Transparency” program — scoped security reports, alert forwarding, incident summaries, and independent attestation for regulated entity partners

• Coordinate with IFSCA, external auditors, and banking partner audit teams during inspections and certifications

• Drive the SOC 2 Type II certification journey and maintain independent attestations (ISO 27001, PCI DSS)

• Build and maintain a compliance resource center — audit reports, certifications, security

• documentation available for partner due diligence on demand

What We're Looking For

Experience: 4 years in information security with at least 3 years in a hands-on security role, preferably in regulated financial services (fintech, banking, NBFC, payment processors)

Core Expertise:

• Be part of the InfoSec program from the early stage, understand the GRC as well as the Security Function.

• Deep working knowledge of PCI DSS, ISO 27001, SOC 2, and Indian financial regulatory frameworks (RBI, IFSCA)

• Hands-on with experience with cloud security on GCP (strongly preferred) or AWS/Azure

• Experience on both sides of third-party security assessments — being audited and auditing vendors

• Practical expertise in PAM, SIEM, DLP, endpoint hardening, and network security.

The Right Person For This Role:

• You should be able to make sense of SIEM detection rules and alerts and configure the same as well

• Translates regulatory requirements into practical controls without over-engineering

• Holds firm on security non-negotiables while being pragmatic with business constraints

• Writes clean policy documents, audit responses, and regulatory submissions

• Thrives solo in a fast-paced startup where compliance is a competitive advantage, not overhead

• High integrity — this role has access to the most sensitive systems, data, and partner relationships

• Ability to handle audits and provide right and logical justifications where appropriate.

Why Join Glomopay?

• Direct Impact: Report directly to the Head of Information Security. Shape the security foundation of India's first IFSCA-authorized PSP, your actions and decisions define the ecosystem.

• Full Ownership: You will be instrumental in building the entire security program and be a part of the team from scratch. No inherited mess, no bureaucracy — This gives you an opportunity to define the culture from scratch.

• Regulatory Pioneer: You will help define the InfoSec playbook at the intersection of IFSCA, RBI, and global card network requirements.

• Modern Stack: GCP, Terraform IaC, CrowdStrike, Teleport PAM — cloud-native infrastructure, not legacy systems.

• Strategic Moat: Your security program becomes the reason banking partners choose Glomopay. Security here is a revenue enabler, not a cost center.