ISMS & Security Governance | - Own and operate the Enterprise Information Security Governance & IT Risk Management program aligned to ISO 27001:2022, NIST CSF and DPDP Act.
- Develop, review and renew policies, standards and SOPs maintain the policy renewal tracker and secure stakeholder/management approvals.
- Evaluate the organization's security posture periodically and report to stakeholders.
|
Security Assessment & Technology Due Diligence | - Conduct InfoSec assessments for new/existing projects and applications on a Secure-by-Design basis - review architecture, data flows and controls, and perform threat modelling.
- Assess controls, identify gaps, provide residual-risk assessments and track risk-treatment actions.
- Validate implementation (controls, VAPT, secure code review, logging/monitoring) and provide initial and final production sign-offs.
|
Application, API & Infrastructure Security | - Govern application & API security - assess against InfoSec/AppSec checklists, oversee VA, PT and secure code reviews, and drive DevSecOps integration and application-layer attack mitigation.
- Maintain MBSS / Secure Configuration Documents (SCD) oversee configuration VA and compliance reviews.
- Maintain infrastructure security baselines, assess assets periodically, track and close observations with stakeholders.
|
Enterprise Vulnerability Management | - Lead the Enterprise Vulnerability Management program across applications, infrastructure and configurations.
- Prioritise vulnerabilities by severity, business impact and exploitability manage exceptions and escalate overdue items.
- Monitor remediation progress and ensure timely closure and reporting.
|
Cloud Security Governance | - Implement and oversee cloud security best practices across AWS & Azure - IAM, encryption, network security and logging.
- Conduct cloud security, gap and compliance assessments for IaaS/PaaS/SaaS and remediate misconfigurations.
- Monitor and manage CNAPP tooling (CSPM, CIEM, CWPP) for continuous cloud posture management.
|
Security Operations, SIEM & Incident Management | - Govern SIEM/SOC monitoring - asset onboarding, monthly reconciliation, use-case/detection enhancement and alert triage & closure.
- Oversee operational management of security tools (SIEM, EDR, DLP, WAF, IDS/IPS).
- Own incident management - detection, RCA, mitigation, monthly incident reporting and a learning matrix driving preventive controls.
|
Audit, Compliance & Regulatory Management | - Manage internal, statutory, regulatory and certification audits - coordinate evidence, provide management responses/remediation plans and track observations to closure.
- Address queries from Compliance, Internal/External Audit and Regulators implement policy/process updates for regulatory changes.
- Participate in CAB and assess the security implications of planned and emergency changes.
|
Business Continuity & Disaster Recovery | - Maintain the annual DR drill calendar and secure committee approvals govern DR drills for critical applications/infrastructure.
- Validate RTO/RPO achievement, close DR observations and maintain DR documentation for audit/regulatory purposes (BIA, BCRA, FRP, IT DR drills).
|
Third-Party Risk & Vendor Governance | - Drive Vendor Risk Assessment (VRA) and TPRM - maintain vendor inventory & criticality and the annual review calendar.
- Ensure timely completion of vendor assessments, review risk ratings and track closure of identified risks.
|
Awareness, Resilience & Executive Reporting | - Run monthly awareness campaigns, annual training and phishing simulations with targeted remediation execute annual CCMP tabletop / IR simulations.
- Prepare and present ITSC, IT Strategy Committee, RMC and Board reporting - InfoSec metrics, risk dashboards, KPI/KRI, compliance and audit status, and incident summaries track decisions and action closure.
|
