Lead - Product Security

Designation : Lead - Product Security

Roles & Responsibilities

1. Security Strategy & Leadership

• Define the vision, charter, and operating model for Razorpay's security function across Product Security, Cloud Security, and Security Operations, including Incident Response.
• Establish security priorities, roadmaps, and measurable outcomes aligned with business objectives, engineering strategy, and risk appetite.
• Lead and develop a high-performing team of security engineers, fostering technical excellence, ownership, collaboration, and continuous learning.
• Drive proactive identification, assessment, and mitigation of security risks across products, infrastructure, and critical systems.

2. Product Security & Secure Engineering

• Lead product security initiatives to ensure security is embedded throughout the software development lifecycle, from design and development to deployment and production.
• Partner with engineering teams, tech leads, and architects to identify security vulnerabilities, review system designs, and implement effective security controls.
• Establish and scale security engineering practices, including threat modelling, secure code reviews, security testing, vulnerability management, and remediation processes.
• Champion secure-by-design principles and help engineering teams build resilient, scalable, and secure products.

3. Cloud Security & Security Operations

• Drive cloud security strategy and governance, ensuring robust security controls across cloud infrastructure, workloads, identities, and sensitive data.
• Oversee security operations, monitoring, threat detection, and incident response capabilities to strengthen organisational resilience.
• Establish effective incident management and response processes, ensuring timely investigation, containment, remediation, and post-incident learning.
• Continuously evaluate the effectiveness of security controls, operational processes, and risk mitigation strategies.

4. Engineering Collaboration & Security Evangelism

• Build strong partnerships with the CTO, VPs, Engineering Managers, Senior ICs, and other key stakeholders across the engineering organisation.
• Influence engineering strategy and architectural decisions by bringing security considerations into technical discussions early.
• Evangelise security best practices and enable engineering teams to take shared ownership of security outcomes.
• Translate complex security risks into clear, actionable recommendations for both technical and non-technical stakeholders.
• Drive adoption of security standards, tools, and engineering processes without compromising development velocity or product quality.

Mandatory Qualifications

• Bachelor's degree in Computer Science, Engineering, or a related technical field. A master's degree is a plus.
• 8+ years of experience in software development roles, such as Software Engineer, Tech Lead, Engineering Manager, or equivalent positions.
• Demonstrated experience managing Product Security teams and leading security engineering initiatives.
• Strong understanding of security principles, secure software development, application security, threat modelling, vulnerability management, and risk assessment.
• Proven track record of implementing effective engineering processes and driving their adoption across teams.
• Strong technical depth and the ability to partner with tech leads and architects to solve complex engineering and security problems.
• Excellent written and verbal communication skills, with the ability to explain security concepts and risks to non-security teams.
• Demonstrated ability to make concrete progress in ambiguous environments with incomplete information.
• Ability to manage high-pressure situations, make sound decisions, and engage effectively with senior stakeholders.
• Strong analytical thinking, problem-solving, collaboration, and interpersonal skills.

What Success Looks Like

• A clearly defined and effectively executed security strategy across product, cloud, and security operations.
• Security integrated into engineering workflows, architecture decisions, and the software development lifecycle.
• A high-performing security team with strong technical capabilities, clear ownership, and measurable impact.
• Improved security posture through proactive risk identification, timely vulnerability remediation, and effective incident response.
• Strong security ownership across engineering teams, with consistent adoption of secure engineering practices.
• Effective collaboration between security and engineering leadership, enabling secure product innovation at scale.