CHENNAI · FULLTIME
Senior Security Manager
Disprz
Chennai · onsite · Posted 5d ago
Sourced from
Undisclosed18–20 yrsfulltimeChennai
Your match
?
Sign in to see your match score, skill gaps & tailored resume.
Section · 01
About this role
Senior Security Manager / Director - Information Security
Location: Chennai
Function: Information Security / Cybersecurity
Reporting to: CTO / COO
Experience: 10-18+ years
Industry: SaaS / Enterprise Software / Technology Products
Role Overview
We are looking for a seasoned Information Security leader to build, operate and continuously mature the companys enterprise and product security programme. The individual will perform the responsibilities of a CISO, with ownership across information
security strategy, product security, cloud security, cybersecurity risk, compliance, privacy collaboration, security governance, incident response and customer security assurance. This is a highly visible leadership role requiring close partnership with the Engineering, Product, Cloud/Infrastructure, Legal, Compliance, HR, Sales and Customer Success teams. The successful candidate will be expected to balance security, business enablement and customer trust, rather than treating security purely as a compliance or IT function.
Key Responsibilities
1. Information Security Strategy Governance
- Define and execute the companys multi-year Information Security and Cybersecurity strategy aligned with business and product objectives.
- Establish and maintain the enterprise Information Security Management System (ISMS).
- Develop security policies, standards, procedures and control frameworks.
- Establish security governance, metrics, KRIs/KPIs and executive reporting.
- Present security posture, material risks, incidents and remediation progress to the executive leadership team and, where required, the Board.
- Maintain an enterprise-wide cybersecurity risk register and drive remediation of material risks.
- Define security architecture and technology principles in partnership with Engineering and IT.
2. Product Application Security
- Own the Product Security portfolio covering the SaaS platform, web applications, APIs, mobile applications and supporting services.
- Embed security into the SDLC and DevSecOps lifecycle.
- Establish application-security standards covering secure coding, threat modelling, SAST,
- DAST, SCA, API security, secrets management and vulnerability management.
- Establish appropriate penetration testing and application security assessment programmes.
- Partner with Engineering to ensure security vulnerabilities are prioritised and remediated based on business risk.
- Drive security-by-design for new products, features, integrations and architectural changes.
- Establish and maintain Software Supply Chain Security / SBOM practices.
3. Cloud Infrastructure Security
- Own the security posture of the companys cloud environments and supporting infrastructure.
- Establish cloud security standards covering IAM, network security, encryption, logging, configuration management, workload security and data protection.
- Partner with Cloud/DevOps teams to implement Cloud Security Posture Management and secure infrastructure-as-code practices.
- Ensure appropriate segregation of production, non-production and customer environments.
- Review and approve security aspects of major infrastructure and architectural changes.
4. Security Operations Incident Response
- Establish and oversee the companys cybersecurity monitoring and detection capabilities.
- Define and maintain an enterprise Incident Response and Cyber Crisis Management framework.
- Lead or coordinate response to significant security incidents, data breaches and cyber events.
- Establish incident severity, escalation and communication protocols.
- Conduct post-incident reviews and ensure corrective actions are implemented.
- Maintain relationships with relevant external security partners, incident-response providers and law-enforcement/regulatory bodies where appropriate.
5. Vulnerability Risk Management
- Establish an enterprise-wide vulnerability management programme.
- Define risk-based remediation SLAs and exception-management processes.
- Oversee vulnerability identification across applications, infrastructure, cloud environments
- and third-party components.
- Drive periodic security assessments, penetration testing and risk reviews.
- Ensure security risks are tracked through to closure.
6. Compliance Certifications
- Own and continuously mature the companys security compliance programme, including relevant
- frameworks and standards such as:
- ISO 27001
- SOC 2 Type II
- ISO 42001
- GDPR / applicable data-protection regulations
- India DPDP Act and related requirements
- Customer specific security and regulatory requirements
- Other industry specific frameworks applicable to the companys markets
- Lead internal and external security audits.
- Ensure audit findings are appropriately remediated.
- 21 CFR Part 11 / EU GMP Annex 11 compliance
- Maintain evidence, control ownership and audit readiness throughout the year rather than only during audit periods.
7. Customer Security Trust
- Own the security component of customer due diligence and enterprise security assessments.
- Partner with Sales, Pre-Sales and Customer Success on security questionnaires, RFPs and customer audits.
- Develop standard security responses, trust documentation and evidence repositories.
- Participate in strategic customer meetings involving cybersecurity, privacy, compliance and risk.
- Establish a scalable mechanism for responding to customer security requirements without creating unnecessary engineering overhead.
- Support the development and maintenance of customer-facing security/trust documentation.
8. Data Protection Privacy Collaboration
- Partner closely with the DPO / Legal / Privacy function on information-security aspects of privacy compliance.
- Support DPIAs, data-processing assessments and privacy-by-design initiatives.
- Ensure security controls support applicable data retention, deletion, access and breach- notification requirements.
9. Business Continuity Resilience
- Own cybersecurity aspects of Business Continuity and Disaster Recovery.
- Establish recovery objectives and security requirements for critical SaaS services.
- Conduct periodic DR, cyber-resilience and crisis simulations.
- Ensure backup, recovery and resilience controls are appropriately protected against cyber threats such as ransomware.
- Partner with Engineering/Infrastructure teams to validate recovery capability.
10. Third-Party Supply-Chain Security
- Establish a risk-based Third-Party Risk Management programme.
- Assess security posture of critical vendors, SaaS providers, cloud providers and technology partners.
- Define security requirements for vendor onboarding and contracting.
- Conduct periodic reassessment of critical suppliers.
- Establish appropriate security clauses, audit rights and breach-notification requirements in collaboration with Legal.
11. Security Awareness Culture
- Establish an organisation-wide security awareness programme.
- Conduct phishing simulations, secure-development training and role-specific security raining.
- Build a culture where security is considered a shared responsibility across Engineering,
- Product, IT and business teams.
- Establish security champions within engineering/product teams.
12. Emerging Technology AI Security
- Establish security governance for the companys adoption of Generative AI, AI agents, LLMs and other emerging technologies.
- Assess risks associated with AI-enabled product features and internal AI usage.
- Define controls for data leakage, model access, prompt injection, supply-chain risks and inappropriate use of sensitive information.
- Partner with Product, Engineering, Legal and Privacy teams on responsible and secure AI adoption.
Candidate Profile
Essential
- 10-18+ years of experience in Information Security / Cybersecurity.
- Significant experience in a SaaS, cloud, technology product or enterprise software environment.
- Demonstrated ownership of an enterprise-wide security programme.
- Strong understanding of both Product Security and Enterprise Information Security.
- Experience with ISO 27001, SOC 2 and GDPR.
- Strong understanding of cloud security, preferably across AWS and/or Azure.
- Strong application-security and DevSecOps understanding.
- Experience managing security incidents and cyber-risk programmes.
- Experience interacting with enterprise customers on security assessments.
- Strong understanding of security governance, risk and compliance.
- Demonstrated ability to influence senior Engineering, Product and Business leaders.
- Exposure to AI security / AI governance.
Preferred
- CISSP / CISM / CCSP / CRISC or equivalent.
- Experience taking a SaaS company through SOC 2 / ISO 27001 certification and subsequent maturation.
- Experience with GDPR / DPDP and international privacy requirements.
- Experience with enterprise customer security audits.
- Experience with security architecture and threat modelling.
- Experience with SBOM / software supply-chain security.
- Prior experience as CISO, Deputy CISO, Head of Information Security, Director - Information
- Security or Associate Director - Information Security.
Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.
Sourced from naukri
Let the agent run this one for you.
Tailored resume, auto-apply, and referral lookup — in under 2 minutes.
Section · 02
Skills
SOCAssuranceAuditingconfiguration managementDisaster recoveryIso 27001MonitoringNetwork SecurityInformation SecurityPresales
Section · Company
About Disprz
Disprz
Internet
226
employees
2015
11 years old
West Orange,New Jersey
United States
About
Disprz provides a corporate learning management system with various training features, empowering organizations to enhance workforce skills and streamline knowledge sharing.
Industries
Internet
Employee ratings
67 reviews
3.1/ 5
Culture
3.1
Career growth
3.0
Work-life
3.4
Employees rate it well for
Job Security12Senior Management8Work Life Balance6Salary4Work Culture4
Find them on