Information Security and Data Protection Lead

Lead, Information Security and Data Protection

Experience: 7–9 Years

Location: Chennai

About the Role

We are looking for a Lead, Information Security and Data Protection to own and strengthen our India regulatory compliance, information security and privacy programmes. This role will establish a sustainable control framework, maintain audit readiness, oversee certification requirements and build a reliable partner assurance process to support enterprise and insurer relationships.

Key Responsibilities

• Regulatory Compliance: Own IRDAI compliance for service provider operations, maintain control mappings and conformance matrices, and manage sub-outsourcing registers and prior written permission workflows.
• Data Protection: Build and maintain the DPDP operating model, covering data inventory, data flows, consent management, retention schedules, data principal rights and grievance redressal.
• Data Protection Officer: Establish the India-based DPO function, including published contact details and a formal escalation path to the board.
• Certifications and Audits: Lead the ISO 27001:2022, ISO 27701 and SOC 2 Type II certification programmes, coordinate auditor relationships, maintain the Statement of Applicability and align India operations with the global HIPAA programme.
• Partner Assurance: Develop a reusable security trust pack, standardised questionnaire responses and control narratives to accelerate insurer and enterprise procurement. Track and reduce partner clearance timelines.
• Third-Party Risk Management: Establish vendor risk assessment frameworks, contractual security annexures, audit access provisions and data processing agreements.
• Regulatory Horizon Scanning: Monitor upcoming regulatory changes, assess their operational impact and develop implementation plans for evolving IRDAI, DPDP and related requirements.
• Healthcare Compliance: Oversee CDSCO cybersecurity documentation for software submissions and assess ABDM/NDHM compliance requirements for potential integrations.
• Incident Governance: Own incident response playbooks, regulatory reporting templates, escalation procedures, tabletop exercises and notification timelines, including six-hour and 72-hour reporting requirements where applicable.

Candidate Requirements

• 7–9 years of experience in information security and privacy, including at least 3 years owning and managing a programme.
• Proven experience building a compliance function from the ground up and leading a first-time ISO 27001 certification or SOC 2 Type II audit.
• Direct working knowledge of IRDAI information security requirements and the DPDP Act and Rules.
• Experience handling audits and security assessments for regulated clients from the service provider or vendor side.
• Background in insurance, information security, healthcare, third-party administration or fintech is strongly preferred.
• Strong written English and the ability to prepare policies, board papers, regulatory correspondence and enterprise-facing security documentation.
• Relevant certifications such as CISM, CISA, CIPP/E, DCPP, ISO 27001 Lead Implementer or ISO 27001 Lead Auditor.

Preferred Profile

A programme owner who can build scalable compliance systems, anticipate regulatory changes and establish repeatable audit and partner assurance processes. The role focuses on governance, control ownership and strategic execution rather than routine evidence collection or administrative audit support.