BENGALURU · FULLTIME
Information Security Associate
Glomo
Bengaluru · onsite · Posted 69d ago
Sourced from
Not disclosed4–6 yrsfulltimeBengaluru
About a minute. You'll make an account on the way through.
agent · working
- Read this posting0.7s
- Found the form on Foundit · 9 questions to answer1.1s
- Decided the answers for all of them2.6s
- Tailor your résumé to this role
- Waiting for you
Section · 01
About this role
As a member of the Information Security Team at Glomopay, you will own the entire information security
function — from policy and governance to hands-on implementation and regulatory compliance. Reporting
directly to the Head of Information Security, this is a strategic role for a security practitioner who can single-handedly stand up a mature InfoSec program for Glomo
Key Responsibilities
Security Governance & Compliance
Experience: 4 years in information security with at least 3 years in a hands-on security role, preferably in regulated financial services (fintech, banking, NBFC, payment processors)
Core Expertise:
function — from policy and governance to hands-on implementation and regulatory compliance. Reporting
directly to the Head of Information Security, this is a strategic role for a security practitioner who can single-handedly stand up a mature InfoSec program for Glomo
Key Responsibilities
Security Governance & Compliance
- Own the Information Security Management System (ISMS) — policy framework, risk assessments and control implementation aligned with ISO 27001, PCI DSS, and IFSCA Cyber Security and
- Cyber Resilience Framework
- Lead compliance with RBI outsourcing directions, IFSCA circulars, DPSC guidelines, and PCI SSF requirements applicable to payment service providers
- Own third-party risk management — conduct due diligence audits on all technology partners and maintain records per regulatory requirements
- Drive the internal IT audit program — plan, execute, engage external audit vendors, and track findings to closure
- Establish the Information Classification framework, embedding it into DLP rules, employee training, and daily operations
- Build and manage the SOC function — starting with MDR-augmented operations (CrowdStrike), progressively maturing toward hybrid capability
- Own the SIEM strategy: integrate and monitor all critical log sources (application, infrastructure, database, identity, PAM) and build detection use-cases
- Conduct threat modelling Manage Privileged Access Management (PAM) — session monitoring, password rotation,break-glass procedures, periodic user access reviews
- Implement and manage DLP controls across endpoints, email, and cloud storage (Google Workspace DLP, CrowdStrike Device Control)
- Own endpoint security — hardening SOPs against CIS benchmarks, approved software lists, full disk encryption
- Drive network security posture — geo-fencing, firewall rule reviews, Cloud IDS tuning across GCP infrastructure
- Oversee application security — integrate SAST/DAST into CI/CD pipelines, define security review thresholds, manage OWASP compliance
- Own the incident management lifecycle — severity classifications, closure SLAs, escalation
- procedures, post-incident reviews
- Establish a dedicated security incident reporting channel and ensure organization-wide awareness
- Maintain and test the Business Continuity Plan covering office unavailability, power failure,
- pandemic, and cloud provider disruption scenarios
- Ensure DR drills meet RTO thresholds with proper segregation of duties
- Serve as the primary point of contact during security incidents, coordinating response with banking partners and regulators per notification SLAs
- Serve as the primary security interface with banking partners, managing their Third Party Service provider Risk Assessments
- Build the Managed Security Transparency program — scoped security reports, alert forwarding, incident summaries, and independent attestation for regulated entity partners
- Coordinate with IFSCA, external auditors, and banking partner audit teams during inspections and certifications
- Drive the SOC 2 Type II certification journey and maintain independent attestations (ISO 27001, PCI DSS)
- Build and maintain a compliance resource center — audit reports, certifications, security
- documentation available for partner due diligence on demand
Experience: 4 years in information security with at least 3 years in a hands-on security role, preferably in regulated financial services (fintech, banking, NBFC, payment processors)
Core Expertise:
- Be part of the InfoSec program from the early stage, understand the GRC as well as the Security Function.
- Deep working knowledge of PCI DSS, ISO 27001, SOC 2, and Indian financial regulatory frameworks (RBI, IFSCA)
- Hands-on with experience with cloud security on GCP (strongly preferred) or AWS/Azure
- Experience on both sides of third-party security assessments — being audited and auditing vendors
- Practical expertise in PAM, SIEM, DLP, endpoint hardening, and network security.
- You should be able to make sense of SIEM detection rules and alerts and configure the same as well
- Translates regulatory requirements into practical controls without over-engineering
- Holds firm on security non-negotiables while being pragmatic with business constraints
- Writes clean policy documents, audit responses, and regulatory submissions
- Thrives solo in a fast-paced startup where compliance is a competitive advantage, not overhead
- High integrity — this role has access to the most sensitive systems, data, and partner relationships
- Ability to handle audits and provide right and logical justifications where appropriate.
- Direct Impact: Report directly to the Head of Information Security. Shape the security foundation of India's first IFSCA-authorized PSP, your actions and decisions define the ecosystem.
- Full Ownership: You will be instrumental in building the entire security program and be a part of the team from scratch. No inherited mess, no bureaucracy — This gives you an opportunity to define the culture from scratch.
- Regulatory Pioneer: You will help define the InfoSec playbook at the intersection of IFSCA, RBI, and global card network requirements.
- Modern Stack: GCP, Terraform IaC, CrowdStrike, Teleport PAM — cloud-native infrastructure, not legacy systems.
- Strategic Moat: Your security program becomes the reason banking partners choose Glomopay. Security here is a revenue enabler, not a cost center.
Sourced from foundit
Section · 02
Skills
DPSC guidelinesIFSCA Cyber SecurityPCI SSFRBI outsourcing directionsSIEM strategySOC 2 Type II certificationSOC functionThird Party Risk ManagementIso 27001pci dssdastsastNetwork SecurityApplication SecurityIT AuditEndpoint Security
Section · Company
About Glomo
Glomo
Bangalore
IN
About
Glomo is a fintech firm that provides cross-border payments, identity verification, and treasury infrastructure for enterprises. Glomo is a financial technology firm that provides infrastructure for cross-border payments, identity verification, and treasury operations. The company offers payment rails that support global businesses, marketplaces, and financial institutions in sending and receiving funds across borders. Its platform embeds KYC and identity verification tools into onboarding and transaction flows to help customers meet compliance requirements. Glomo also provides treasury and liquidity management capabilities so enterprises can manage multi-currency balances and settlement. Through products such as checkout, payment links, subscriptions, payouts, outward remittance, and global treasury, it supports a range of payment and payout use cases. Glomo serves financial institutions, marketplaces, and international businesses that need programmable cross-border payment and investment flows.
Industries
AdviceConsultingFinancial Services
Employee ratings
1 reviews
1.0/ 5
Culture
1.0
Career growth
1.0
Work-life
1.0
Find them on