4) Key Result Areas

Key results expected from the job and the supporting actions for each key result area.

Key Result Areas

Supporting Actions

ISMS & Security Governance

- Own and operate the Enterprise Information Security Governance & IT Risk Management program aligned to ISO 27001:2022, NIST CSF and DPDP Act.
- Develop, review and renew policies, standards and SOPs; maintain the policy renewal tracker and secure stakeholder/management approvals.
- Evaluate the organization’s security posture periodically and report to stakeholders.

Security Assessment & Technology Due Diligence

- Conduct InfoSec assessments for recent/existing projects and applications on a Secure-by-Design basis — review architecture, data flows and controls, and perform threat modelling.
- Assess controls, identify gaps, provide residual-risk assessments and track risk-treatment actions.
- Validate implementation (controls, VAPT, secure code review, logging/monitoring) and provide initial and final production sign-offs.

Application, API & Infrastructure Security

- Govern application & API security — assess against InfoSec/AppSec checklists, oversee VA, PT and secure code reviews, and drive DevSecOps integration and application-layer attack mitigation.
- Maintain MBSS / Secure Configuration Documents (SCD); oversee configuration VA and compliance reviews.
- Maintain infrastructure security baselines, assess assets periodically, track and close observations with stakeholders.

Enterprise Vulnerability Management

- Lead the Enterprise Vulnerability Management program across applications, infrastructure and configurations.
- Prioritise vulnerabilities by severity, business impact and exploitability; manage exceptions and escalate overdue items.
- Monitor remediation progress and ensure timely closure and reporting.

Cloud Security Governance

- Implement and oversee cloud security best practices across AWS & Azure — IAM, encryption, network security and logging.
- Conduct cloud security,



gap and compliance assessments for IaaS/PaaS/SaaS and remediate misconfigurations.
- Monitor and manage CNAPP tooling (CSPM, CIEM, CWPP) for continuous cloud posture management.

Security Operations, SIEM & Incident Management

- Govern SIEM/SOC monitoring — asset onboarding, monthly reconciliation, use-case/detection enhancement and alert triage & closure.
- Oversee operational management of security tools (SIEM, EDR, DLP, WAF, IDS/IPS).
- Own incident management — detection, RCA, mitigation, monthly incident reporting and a learning matrix driving preventive controls.

Audit, Compliance & Regulatory Management

- Manage internal, statutory, regulatory and certification audits — coordinate evidence, provide management responses/remediation plans and track observations to closure.
- Address queries from Compliance, Internal/External Audit and Regulators; implement policy/process updates for regulatory changes.
- Participate in CAB and assess the security implications of planned and emergency changes.

Business Continuity & Disaster Recovery

- Maintain the annual DR drill calendar and secure committee approvals; govern DR drills for critical applications/infrastructure.
- Validate RTO/RPO achievement, close DR observations and maintain DR documentation for audit/regulatory purposes (BIA, BCRA, FRP, IT DR drills).

Third-Party Risk & Vendor Governance

- Drive Vendor Risk Assessment (VRA) and TPRM — maintain vendor inventory & criticality and the annual review calendar.
- Ensure timely completion of vendor assessments, review risk ratings and track closure of identified risks.

Awareness, Resilience & Executive Reporting

- Run monthly awareness campaigns, annual training and phishing simulations with targeted remediation; execute annual CCMP tabletop / IR simulations.
- Prepare and present ITSC, IT Strategy Committee, RMC and Board reporting — InfoSec metrics, risk dashboards, KPI/KRI, compliance and audit status, and incident summaries; track decisions and action closure.

📌 Lead - Information Security and GRC (Gurugram)
🏢 Financial services
📍 Gurugram