Information Security Manager

JOB DESCRIPTION

Role Title/ Job TitleManager / Asst Manager Information Security Employee InterviewedNAReports ToSenior Manager Information Security Company DMI Finance Pvt Function/ DepartmentITDate (written on)6th August 20256

1. JOB PURPOSE

(Summarize in one statement why the job exists; and how it contributes to the overall objective of the company)

Assist, Analyse and improve in securing organizations sensitive information for DMI Finance . Needs to work across the group to identify and correct flaws in the companys security systems, solutions, and programs while recommending specific measures that can improve the companys overall security posture. Gather information and create attack surface with offensive security metrics and able to defend the loopholes.

1. ORGANISATIONAL CHART

(First level reporting chart for the job)




Comments:

• Numerical figure represents the total number of incumbents in the role

1. PRINCIPAL ACCOUNTABILITIES

(Accountabilities associated with the job)

A. Information Security Risk & Control Assessment

• Perform periodic information security risk assessments, control-gap assessments and inherent/residual risk analysis.
• Identify critical information assets, business services, customer data and associated security risks; maintain risk registers and treatment plans.
• Evaluate security controls for design and operating effectiveness and recommend risk-based remediation.
• Track remediation of high and critical risks and escalate overdue or unacceptable risks to management.

B. Vulnerability Assessment, Penetration Testing & Attack Surface Management

• Coordinate and/or perform VA/PT activities covering on-premises infrastructure, cloud environments, networks, servers, endpoints and relevant applications.
• Maintain an enterprise attack-surface view and track externally exposed assets, vulnerabilities and security weaknesses.
• Validate remediation through evidence and retesting, and provide management reporting on exposure, trends and closure.
• Coordinate with technology teams and external security partners to address identified weaknesses.

C. Security Incident, RCA & Resilience

• Support security incident investigation, containment, remediation and closure in coordination with SOC, IT and business teams.
• Document root-cause analysis (RCA), corrective/preventive actions and lessons learned.
• Continuously review and update incident response, disaster recovery and cyber-resilience plans based on emerging threats, incidents and business changes.
• Support security aspects of BCP/DR exercises and track closure of identified gaps.

D. Third-Party / Vendor Security

• Perform or coordinate information security assessments of third-party vendors and service providers.
• Validate adherence to contractual, regulatory and organizational security requirements.
• Track vendor security risks, remediation commitments, exceptions and periodic reassessments.

E. Audit, GRC & Regulatory Compliance

• Coordinate internal and external information security audits, certifications and regulatory assessments.
• Maintain audit evidence, action trackers, control documentation and closure status.
• Support compliance with applicable RBI, ISO 27001 and organizational information security requirements, as applicable to the role.
• Prepare inputs and management reporting for Information Security Committee, IT Steering Committee, Board and other governance forums.
• Report regulatory/standards-related security violations and material risks through the defined governance mechanism.

F. Security Monitoring, Metrics & Reporting

• Develop and maintain information security KPIs/KRIs covering vulnerabilities, incidents, risks, audit findings, compliance, third parties and security controls.
• Prepare periodic management dashboards highlighting high risks, inherent risks, control gaps, trends, ageing and remediation status.
• Support security awareness initiatives and targeted communication based on identified risk themes.

G. Cloud Security, Automation & Technology Enablement

• Identify opportunities to automate security controls, evidence collection, monitoring and compliance activities, particularly in cloud environments.
• Assess security architecture and controls for new technology deployments and business initiatives.
• Collaborate with IT/Cloud/DevOps teams to embed security controls into technology delivery and operational processes.

H. Governance, Documentation & Continuous Improvement

• Review and update information security policies, standards, procedures, guidelines and control documentation based on business and regulatory requirements.
• Support security reviews for new projects, technologies and significant changes.
• Identify opportunities to improve security processes, control maturity, operational efficiency and risk visibility.

1. MAJOR CHALLENGES

(Challenges faced on an on-going basis in carrying out the job)

• Managing cyber and technology risks arising from rapid business growth, digital transformation, cloud adoption and new IT deployments.
• Identifying unknown, emerging and interconnected risks across applications, infrastructure, third parties and the external attack surface.
• Driving timely remediation of high-risk findings across multiple technology and business stakeholders.
• Maintaining effective incident readiness and ensuring timely escalation of material security events.
• Balancing regulatory/security requirements with business enablement, operational feasibility and risk appetite.

1. DECISIONS

(Key decisions which the role needs to escalate to superior)

• Identify and escalate high/critical information security risks, control failures, material audit observations and security incidents.
• Prioritize security remediation based on business criticality, risk exposure, threat intelligence and regulatory requirements.
• Recommend risk treatment, compensating controls and security improvements for management approval.
• Determine when issues require escalation to senior management, governance committees or other defined stakeholders.

1. DIMENSIONS

(Key numerical data which will reflect the scope and scale of activities concerning this job)

Financial Dimensions (FY 26)
(These should be quantifiable numerical amounts)

• Track monthly and quarterly progress of security projects, audits, risk remediation and compliance activities.
• Monitor budget versus actuals for assigned security initiatives, where applicable.
• Manage/coordinate assigned team members and third-party resources.
• Current indicative team size: 2; direct reports: 2; outsourced employees: 0 (subject to organizational structure).
• Key performance indicators may include closure of high/critical risks, VA/PT remediation SLA, audit closure, incident readiness, compliance status, security KPI/KRI performance and automation improvements.

Other Dimensions (FY 26)
(Significant volume dimensions associated with the job)

• Total Team Size: 2
• Number of Direct Reports:1
• Number of Outsourced employees: 4

1. SKILLS AND KNOWLEDGE

(Minimum acceptable proficiency for this job which best indicates the education and/or experience requirements of this job and not the incumbent)

Educational Qualifications
a) Qualifications

• Minimum Qualification required: Graduate.
• Technical certification: Understanding of ISO, Cloud Security, GRC, Dash Boards

b) Work Experience

• Minimum 5 years of relevant experience in Information Security, Cyber Security, IT Risk, GRC, VAPT, Security Operations or a comparable role.
• Communication skills : Expert
• Collaboration skills : Expert

1. INDICATIVE SUCCESS MEASURES

• Reduction in ageing high/critical security vulnerabilities and audit observations.
• Timely completion of security assessments and regulatory/audit commitments.
• Improved visibility of enterprise cyber risk and attack surface.
• Improved incident readiness, RCA quality and closure of corrective actions.
• Improved third-party security assurance and exception management.
• Increase in automated security controls, monitoring and compliance evidence collection.
• Effective management reporting with clear risk ownership, ageing and remediation actions

1