Job role:

The Information Security Manager will serve as the organization's subject-matter expert for cybersecurity protection, detection, response, and recovery. This role is accountable for guiding the design, implementation, and continuous improvement of an enterprise-wide security framework, and for acting as the primary point of contact for information security matters across internal teams, external partners, and customers.

Key responsibilities:

Stakeholder & Team Leadership

Serve as the primary point of contact between the internal information security team, external security partners, and customers/business stakeholders.
Manage internal and external security team members, including third-party security service providers.
Communicate information security goals, initiatives, and new programs clearly and effectively to department managers and other stakeholders across the organization.

Security Strategy & Architecture

Guide the IT function and other business units in developing, evolving, and maintaining a comprehensive enterprise security framework.
Lead the development of baseline infrastructure and application hardening guides based on industry best practices, providing leadership and expertise on current security solutions and configurations.
Assess business processes, technology, and IT architecture at the logical, system, and component levels to evaluate risk posture and determine appropriate security models and controls.
Evaluate vendor and internal products for security capabilities and integration into the organization's computing environment, ensuring alignment with business objectives and responsiveness to evolving trends.
Evaluate new and emerging security technologies and stay current with industry trends and developments.

Governance, Risk & Compliance

Lead the design, implementation, and maintenance of an ISO 27001, PCI-DSS, DPDP, and GDPR compliant security framework.
Conduct periodic internal assessments against ISO 27001 and PCI-DSS requirements, and guide the team in addressing and closing identified gaps.
Oversee information security audits, whether performed internally or by third-party assessors.
Continuously audit policies and controls to ensure ongoing compliance and operational effectiveness.

Security Operations

Own and maintain security systems and controls, including firewalls, data protection (DLP), patch management, encryption, vulnerability scanning, and penetration testing.
Ensure round-the-clock (24x7) monitoring of all security operations and infrastructure.
Maintain all security tools and technologies with support from internal teams and external partners.
Implement and oversee technology upgrades, improvements, and major changes to the information security environment.

Incident Response & Risk Management

Develop and maintain a detailed Security Incident Response Program, including playbooks covering detection, containment, eradication, and recovery.
Partner with departments across the organization to identify, assess, and reduce information security risk.

Awareness & Training

Design and deliver information security awareness training programs for organizational personnel.

Qualifications & Skills

Education

Bachelor's degree in Information Technology, Computer Science, or an equivalent discipline.

Experience

12 to 14 years of relevant experience in information security / cybersecurity roles.

Technical Expertise

Strong technical knowledge of the organization's applications, systems, network, and infrastructure.
Working knowledge of cloud security across AWS, GCP, and/or Azure, along with application and network security.
Deep understanding of technologies and architecture within highly scalable enterprise networks.
Strong understanding of logging mechanisms across Windows, Linux, and macOS platforms, along with core networking concepts.
Hands-on proficiency with EDR, DLP, Anti-Virus, Vulnerability Management, HIPS, NIDS/NIPS, full packet capture, host-based and network-based forensics, and encryption technologies.
In-depth knowledge of the architecture, engineering, and operations of at least one enterprise SIEM platform (e.g., ArcSight, QRadar, LogLogic, Splunk).
Demonstrated expertise in developing and executing Incident Response Playbooks (IRPs).

Certifications & Frameworks

Advanced certifications such as CISSP or CISM are an added advantage.
Hands-on exposure to Information Security Management Systems such as ISO 27001, NIST CSF, and NCIIPC guidelines is mandatory.

Soft Skills

Excellent communication skills, with the ability to coordinate effectively across diverse stakeholders within the organization.

Senior Manager Information Security