Senior Security Manager

Senior Security Manager / Director – Information Security

Location: Chennai

Function: Information Security / Cybersecurity

Reporting to: CTO / COO

Experience: 10–18+ years

Industry: SaaS / Enterprise Software / Technology Products

Role Overview

We are looking for a seasoned Information Security leader to build, operate and continuously mature the company's enterprise and product security programme. The individual will perform the responsibilities of a CISO, with ownership across information

security strategy, product security, cloud security, cybersecurity risk, compliance, privacy collaboration, security governance, incident response and customer security assurance. This is a highly visible leadership role requiring close partnership with the Engineering, Product, Cloud/Infrastructure, Legal, Compliance, HR, Sales and Customer Success teams. The successful candidate will be expected to balance security, business enablement and customer trust, rather than treating security purely as a compliance or IT function.

Key Responsibilities

1. Information Security Strategy & Governance

• Define and execute the company's multi-year Information Security and Cybersecurity strategy aligned with business and product objectives.
• Establish and maintain the enterprise Information Security Management System (ISMS).
• Develop security policies, standards, procedures and control frameworks.
• Establish security governance, metrics, KRIs/KPIs and executive reporting.
• Present security posture, material risks, incidents and remediation progress to the executive leadership team and, where required, the Board.
• Maintain an enterprise-wide cybersecurity risk register and drive remediation of material risks.
• Define security architecture and technology principles in partnership with Engineering and IT.

2. Product & Application Security

• Own the Product Security portfolio covering the SaaS platform, web applications, APIs, mobile applications and supporting services.
• Embed security into the SDLC and DevSecOps lifecycle.
• Establish application-security standards covering secure coding, threat modelling, SAST,
• DAST, SCA, API security, secrets management and vulnerability management.
• Establish appropriate penetration testing and application security assessment programmes.
• Partner with Engineering to ensure security vulnerabilities are prioritised and remediated based on business risk.
• Drive security-by-design for new products, features, integrations and architectural changes.
• Establish and maintain Software Supply Chain Security / SBOM practices.

3. Cloud & Infrastructure Security

• Own the security posture of the company's cloud environments and supporting infrastructure.
• Establish cloud security standards covering IAM, network security, encryption, logging, configuration management, workload security and data protection.
• Partner with Cloud/DevOps teams to implement Cloud Security Posture Management and secure infrastructure-as-code practices.
• Ensure appropriate segregation of production, non-production and customer environments.
• Review and approve security aspects of major infrastructure and architectural changes.

4. Security Operations & Incident Response

• Establish and oversee the company's cybersecurity monitoring and detection capabilities.
• Define and maintain an enterprise Incident Response and Cyber Crisis Management framework.
• Lead or coordinate response to significant security incidents, data breaches and cyber events.
• Establish incident severity, escalation and communication protocols.
• Conduct post-incident reviews and ensure corrective actions are implemented.
• Maintain relationships with relevant external security partners, incident-response providers and law-enforcement/regulatory bodies where appropriate.

5. Vulnerability & Risk Management

• Establish an enterprise-wide vulnerability management programme.
• Define risk-based remediation SLAs and exception-management processes.
• Oversee vulnerability identification across applications, infrastructure, cloud environments
• and third-party components.
• Drive periodic security assessments, penetration testing and risk reviews.
• Ensure security risks are tracked through to closure.

6. Compliance & Certifications

• Own and continuously mature the company's security compliance programme, including relevant
• frameworks and standards such as:
• ISO 27001
• SOC 2 Type II
• ISO 42001
• GDPR / applicable data-protection regulations
• India DPDP Act and related requirements
• Customer specific security and regulatory requirements
• Other industry specific frameworks applicable to the company's markets
• Lead internal and external security audits.
• Ensure audit findings are appropriately remediated.
• 21 CFR Part 11 / EU GMP Annex 11 compliance
• Maintain evidence, control ownership and audit readiness throughout the year rather than only during audit periods.

7. Customer Security & Trust

• Own the security component of customer due diligence and enterprise security assessments.

• Partner with Sales, Pre-Sales and Customer Success on security questionnaires, RFPs and customer audits.

• Develop standard security responses, trust documentation and evidence repositories.

• Participate in strategic customer meetings involving cybersecurity, privacy, compliance and risk.

• Establish a scalable mechanism for responding to customer security requirements without creating unnecessary engineering overhead.

• Support the development and maintenance of customer-facing security/trust documentation.

8. Data Protection & Privacy Collaboration

• Partner closely with the DPO / Legal / Privacy function on information-security aspects of privacy compliance.
• Support DPIAs, data-processing assessments and privacy-by-design initiatives.
• Ensure security controls support applicable data retention, deletion, access and breach- notification requirements.

9. Business Continuity & Resilience

• Own cybersecurity aspects of Business Continuity and Disaster Recovery.
• Establish recovery objectives and security requirements for critical SaaS services.
• Conduct periodic DR, cyber-resilience and crisis simulations.
• Ensure backup, recovery and resilience controls are appropriately protected against cyber threats such as ransomware.
• Partner with Engineering/Infrastructure teams to validate recovery capability.

10. Third-Party & Supply-Chain Security

• Establish a risk-based Third-Party Risk Management programme.
• Assess security posture of critical vendors, SaaS providers, cloud providers and technology partners.
• Define security requirements for vendor onboarding and contracting.
• Conduct periodic reassessment of critical suppliers.
• Establish appropriate security clauses, audit rights and breach-notification requirements in collaboration with Legal.

11. Security Awareness & Culture

• Establish an organisation-wide security awareness programme.
• Conduct phishing simulations, secure-development training and role-specific security raining.
• Build a culture where security is considered a shared responsibility across Engineering,
• Product, IT and business teams.
• Establish security champions within engineering/product teams.

12. Emerging Technology & AI Security

• Establish security governance for the company's adoption of Generative AI, AI agents, LLMs and other emerging technologies.
• Assess risks associated with AI-enabled product features and internal AI usage.
• Define controls for data leakage, model access, prompt injection, supply-chain risks and inappropriate use of sensitive information.
• Partner with Product, Engineering, Legal and Privacy teams on responsible and secure AI adoption.

Candidate Profile

Essential

• 10–18+ years of experience in Information Security / Cybersecurity.
• Significant experience in a SaaS, cloud, technology product or enterprise software environment.
• Demonstrated ownership of an enterprise-wide security programme.
• Strong understanding of both Product Security and Enterprise Information Security.
• Experience with ISO 27001, SOC 2 and GDPR.
• Strong understanding of cloud security, preferably across AWS and/or Azure.
• Strong application-security and DevSecOps understanding.
• Experience managing security incidents and cyber-risk programmes.
• Experience interacting with enterprise customers on security assessments.
• Strong understanding of security governance, risk and compliance.
• Demonstrated ability to influence senior Engineering, Product and Business leaders.
• Exposure to AI security / AI governance.

Preferred

• CISSP / CISM / CCSP / CRISC or equivalent.
• Experience taking a SaaS company through SOC 2 / ISO 27001 certification and subsequent maturation.
• Experience with GDPR / DPDP and international privacy requirements.
• Experience with enterprise customer security audits.
• Experience with security architecture and threat modelling.
• Experience with SBOM / software supply-chain security.
• Prior experience as CISO, Deputy CISO, Head of Information Security, Director – Information
• Security or Associate Director – Information Security.