Chief Information Security Officer

Role & responsibilities

Information Security Strategy & Governance and Compliance

• Establish Information Security policies, standards, procedures, and governance framework.
• Present security posture and risk updates to Senior Management, Board, and IT Strategy Committee.
• Ensure compliance with RBI and NHB Master Directions on Cyber Security
• Coordinate internal and external regulatory audits and inspections.
• Ensure timely closure of audit observations and CERT-IN advisories.
• Support compliance with applicable privacy laws.

Information Security Risk Management

• Implement endpoint security, email security, network security, and cloud security controls.
• Ensure regular vulnerability assessments and penetration testing (VAPT) and remediation.
• Recommend mitigation strategies, monitor KRI and maintain Information Risk Register.
• Ensure protection of confidential customer data.

Security Operations

• Review security architecture of applications.
• Support cloud security implementation.
• Ensure monitoring of critical systems, RCA for incidents.
• Ensure timely incident reporting and conduct post-incident reviews.

Third Party & Vendor Risk Management

• Assess security posture of outsourced vendors and technology partners.
• Conduct Information Security Due Diligence.
• Review vendor compliance.
• Ensure contractual security clauses.

Business Continuity & Disaster Recovery

• Support Business Continuity Planning (BCP).
• Conduct Disaster Recovery (DR) drills.

Security Awareness

• Develop organization-wide Information Security Awareness Program.
• Deliver cybersecurity training.

Reporting & MIS

• Prepare monthly Information Security Dashboard.
• Report Cyber Security KPIs.
• Present Board-level Information Security reports.