Director of IT and Information Security

We, at Khatabook, are looking for an AD/Director of IT and Information Security to lead enterprise IT strategy, infrastructure, and operations across the organization. The role will own the reliability, security, governance, and scalability of the corporate technology environment while partnering closely with information security, engineering, DevOps, and business leadership. This is a hands-on leadership role requiring strong ownership across IT infrastructure, identity and access, end-user computing, security controls, IT compliance, vendors, budgets, and business continuity.

Responsibilities:

• Run corporate IT for all group entities' networks, firewalls, cloud tenancy, email and collaboration, file storage, and office connectivity against defined SLAs, with SOPs, hardened baselines, and monthly metrics.
• Own identity and access end-to-end: joiner/mover/leaver with same-day revocation on exit, SSO and MFA, conditional access, privileged access, and periodic access reviews with reviewer sign-off rather than console screenshots.
• Own endpoint and asset control through MDM encryption, patch compliance, agent coverage, removable media policy, plus the IT asset register, quarterly reconciliation, and secure decommissioning.
• Administer the corporate security stack jointly with Information Security: EDR/XDR, email security with SPF, DKIM, and DMARC, DLP, firewall and VPN, and central logging. IT leads configuration and tuning; information security sets policy intent. Anything that reduces protective posture needs joint approval with an expiry date.
• Act as the IT-side incident responder for the corporate estate: device isolation, credential revocation, session termination, network blocks, evidence preservation, and close VAPT and configuration findings to the timeline with evidence.
• Own IT compliance evidence across ISO 27001:2022, PCI DSS, the RBI System Audit Report, NPCI requirements, and DPDP obligations, along with change governance and IT risk register closure.
• Own backup and documented restoration testing, IT continuity with defined RTO and RPO, and participation in group BCP/DR exercises.
• Lead and grow the IT team, manage vendors and MSPs, and own budget, licensing, and renewals with costs attributed to the correct legal entity.

Requirements:

• 8-12 years in IT infrastructure and operations, including several years leading IT in fintech, payments, NBFC, or another regulated environment.
• Hands-on administration of EDR/XDR (SentinelOne, CrowdStrike, or Microsoft Defender) and an email security gateway, including SPF, DKIM, and DMARC across sending domains.
• Depth in identity platforms (Google Workspace, Microsoft 365, Okta) and MDM/UEM (Jamf, Intune, Kandji, Scalefusion), plus firewall and network security administration, including rule review and segmentation.
• Practical incident handling on the corporate estate: containment, evidence handling, and escalation.
• Experience operating under ISO 27001, where you ran the controls and produced the evidence yourself, working knowledge of PCI DSS and PADSS as they touch corporate IT, and experience of being audited by internal, certification body, regulatory, or customer/TPRM assessors.
• Working knowledge of AWS and how corporate IT interfaces with the production estate, with strong change management and documentation discipline.
• Good to have: CISM, CISA, CISSP or CEH and ISO 27001 Lead Auditor; exposure to RBI Payment Aggregator guidelines, NPCI circulars and CERT-In directions; hands-on DPDP experience; scripting in Python, Bash or PowerShell.