Unit Manager /Senior Unit Manager - Information Security
Bajaj Finance · Pune · onsite · Posted 1d ago
Undisclosed6–10 yrsfulltimeSourced from
About a minute. You'll make an account on the way through.
About this role
Job Summary
- Lead and govern Cyber Risk Unit BAU operations and strategic security projects covering API security, assurance, vulnerability management, external threat monitoring, brand protection and secure change governance.
- Drive risk-based prioritisation, control effectiveness, issue closure, stakeholder governance, management reporting and regulatory or audit readiness across assigned cyber-risk domains.
- Own the enterprise API security governance framework, standards, control requirements, exception process and operating procedures.
- Maintain visibility of APIs across gateways, applications and business units, including ownership, exposure, authentication method, data classification and lifecycle status.
- Monitor API security events, anomalous usage, authentication failures, sensitive-data exposure patterns and control deviations; coordinate investigation and remediation.
- Conduct periodic governance reviews with API owners and track gaps, exceptions, ageing and closure within agreed timelines.
- Plan and coordinate risk-based API audits covering design, authentication, authorisation, encryption, logging, rate limiting, secrets, data handling and third-party exposure.
- Maintain evidence, observations, root-cause details, action plans and closure validation for internal, external and regulatory audits.
- Assess compliance with approved API standards and applicable OWASP API Security risks; present material findings to relevant governance forums.
- Govern end-to-end VAPT for web applications, Android/iOS mobile applications and APIs across pre-production, production and major-change scenarios.
- Ensure scope finalisation, testing coordination, report quality review, severity validation, false-positive disposition, retesting and formal closure.
- Track vulnerabilities by severity, asset criticality, exploitability, internet exposure and business impact; escalate overdue or high-risk items.
- Coordinate with application, engineering, infrastructure, cloud, product and vendor teams for remediation and compensating controls.
- Oversee monitoring for leaked credentials, exposed customer or employee data, source code, access tokens, confidential documents and threat-actor references.
- Validate alerts, assess impact, initiate containment and takedown workflows, and coordinate incident escalation with SOC, fraud, legal and business teams as applicable.
- Maintain trend reporting, recurring exposure analysis and closure evidence.
- Monitor and coordinate action against phishing domains, fake applications, social-media impersonation, fraudulent advertisements, counterfeit websites and misuse of company trademarks.
- Drive validation, takedown, evidence preservation, stakeholder notification and closure tracking with internal teams and external service providers.
- Report brand-abuse trends, high-impact campaigns and repeat infrastructure to management.
- Govern Security Misconfiguration Tracking (SMT) and related monitoring for security-control deviations, exposed services, configuration weaknesses and recurring hygiene issues.
- Validate findings with asset owners, assign risk and remediation timelines, track ageing, and escalate persistent or critical issues.
- Embed security checks in change-management and CI/CD workflows for new releases, emergency changes and material architecture changes.
- Review security impact, required testing, open vulnerabilities, exceptions and approvals before production deployment.
- Coordinate SAST, DAST, SCA, secrets scanning, container or IaC checks and VAPT evidence, based on change risk and applicability.
- Monitor post-deployment security observations and ensure lessons learned are incorporated into development standards.
- Prepare and publish operational dashboards, KRIs, KPIs, ageing reports, risk-acceptance status, audit updates and project health summaries for leadership.
- Facilitate governance meetings with technology, product, business, SOC, infrastructure, cloud, fraud, compliance, legal, procurement and third-party stakeholders.
- Manage the cyber-risk remediation lifecycle, including ownership, target dates, evidence review, closure validation and escalation.
- Support policy, standard, SOP and control-library updates for assigned Cyber Risk Unit processes.
- Support regulatory inspections, internal audits, external audits and management reviews by providing accurate records and control evidence.
- Identify automation opportunities for monitoring, workflow, evidence collection, reporting and risk-based prioritisation.
- Mentor team members, review deliverable quality and ensure consistent operating practices across BAU activities.
- API Discovery and Inventory Improvement Establish a reliable API inventory, ownership model, risk classification and lifecycle controls across business and technology platforms.
- API Security Monitoring Enhancement Improve use cases, alert quality, dashboards, integrations and response workflows for API threats and anomalies.
- Enterprise VAPT Governance Optimisation Standardise scope, testing methodology, reporting, SLA tracking, retesting, exceptions and risk-based prioritisation.
- Dark Web and Brand Protection Uplift Enhance monitoring coverage, validation, takedown workflows, escalation paths, provider governance and executive reporting.
- DevSecOps Security Gate Integration Integrate proportionate security controls and evidence requirements into CI/CD and enterprise change-management processes.
- Cyber Risk Dashboard and Workflow Automation Automate data ingestion, quality checks, ageing, escalations, metrics and management views across CRU processes.
- Control Rationalisation and Audit Readiness Map operational controls to policies, standards and audit requirements; remove duplication and strengthen evidence quality.
- Third-Party Security Assurance Coordinate security assessments and remediation governance for service providers supporting APIs, applications and monitoring services.
- Strong ownership, analytical thinking and risk-based decision-making.
- Ability to lead security discussions with engineering, product, business and senior-management stakeholders.
- Effective programme management across concurrent BAU and project deliverables.
- Strong written communication, documentation, governance and presentation skills.
- Ability to challenge constructively, manage conflict, drive closure and maintain audit-quality evidence.
- Ability to mentor team members and improve process maturity through standards, automation and measurable outcomes.
- Engineering graduate or equivalent qualification with 6-10 years of relevant experience in Cyber Security, Application Security, Vulnerability Management, Technology Risk or Cyber Risk Operations.
- Hands-on experience in API security governance, VAPT governance, security monitoring, audit coordination and remediation management.
- Experience in a regulated financial-services, banking, NBFC or large enterprise environment is preferred.
- Demonstrated experience in managing multiple BAU workstreams and security-transformation projects with cross-functional stakeholders.
- Strong understanding of web, mobile and API security, OWASP Top 10, OWASP API Security Top 10, common authentication and authorisation patterns, and secure SDLC practices.
- Working knowledge of API gateways, WAF, SIEM, application-security testing tools, CI/CD security controls, threat intelligence and external attack-surface monitoring.
- Ability to assess vulnerability severity, exploitability, business impact, compensating controls and remediation evidence.
- Understanding of audit, risk acceptance, exception management, control testing, incident coordination and regulatory evidence requirements.
- Advanced reporting and analytical skills, including dashboard design, trend analysis, metrics definition and executive communication.
Sourced from naukri
Skills
Automationanalytical thinkingBrand ProtectionCismapisapi securitycehclassificationauditscisspChange Managementaudit coordinationBankingAndroidAPI standardscloudCloud SecurityApplication SecurityArchitecture
About Bajaj Finance
Bajaj Finance
NBFC
64.1k+
employees
1987
39 years old
Pune, Maharashtra
India
About
Bajaj Auto Finance offers Two Wheeler loans, Three Wheeler loans & Quote Loan at low-interest rates.
Industries
NBFCFinancial Services
Employees rate it well for
Work Life Balance807Salary796Work Culture632Work Environment356Career Growth348
Find them on