Chief Information Security Officer (CISO) - General Insurance Company (India)

The Chief Information Security Officer (CISO) is a senior executive responsible for establishing, implementing, and overseeing the organization's information security, cyber security, data protection, and technology risk management framework. In an Indian General Insurance company, the CISO plays a critical role in protecting policyholder data, ensuring regulatory compliance, safeguarding digital channels, and maintaining business resilience.

Position Summary The CISO provides strategic leadership for information security across the enterprise, ensuring that business operations, digital transformation initiatives, cloud adoption, and customer-facing platforms operate securely while complying with IRDAI regulations and applicable cybersecurity standards.

Key Responsibilities

1. Information Security Strategy & Governance

- Develop and execute the enterprise cybersecurity strategy aligned with business and technology objectives.
- Establish security policies, standards, procedures, and governance frameworks.
- Define cybersecurity roadmaps and maturity improvement programs.
- Present security posture, risks, and initiatives to senior management, executive committees, and the Board.

2. Regulatory Compliance & Risk Management

- Ensure compliance with:
- IRDAI Cyber Security Guidelines
- IRDAI Information and Cyber Security Framework
- Digital Personal Data Protection (DPDP) Act
- CERT-In directions
- RBI requirements for insurance intermediaries where applicable
- ISO 27001 and other industry standards
- Lead information security risk assessments across business and IT functions.
- Maintain risk registers and drive remediation of identified vulnerabilities.

3. Cybersecurity Operations

- Oversee Security Operations Center (SOC) activities.
- Manage:
- Security monitoring
- Threat detection
- Incident response
- Threat intelligence
- Vulnerability management
- Ensure timely response to cyber incidents, ransomware attacks, phishing campaigns, and data breaches.

4. Security Architecture & Technology Controls

- Define enterprise security architecture.




- Review and approve security controls for:
- Core insurance systems
- Customer portals
- Mobile applications
- Cloud environments
- APIs and digital ecosystems
- Implement Zero Trust, Identity and Access Management (IAM), Multi-Factor Authentication (MFA), and Privileged Access Management (PAM) solutions.

5. Data Protection & Privacy

- Ensure protection of customer, policyholder, partner, and employee data.
- Implement:
- Data classification
- Encryption
- Data Loss Prevention (DLP)
- Privacy controls
- Lead data privacy compliance initiatives.

6. Third-Party and Vendor Security

- Assess cybersecurity risks associated with:
- TPAs
- Insurance brokers
- Cloud providers
- Technology vendors
- FinTech and InsurTech partners
- Establish vendor risk management frameworks.
- Review security compliance before onboarding third parties.

7. Business Continuity & Resilience

- Oversee cyber resilience programs.
- Support Disaster Recovery (DR) and Business Continuity Planning (BCP).
- Conduct cyber incident simulations and crisis management exercises.
- Ensure operational resilience of critical insurance services.

8. Security Awareness & Culture

- Build a security-conscious culture across the organization.
- Conduct awareness programs on:
- Phishing
- Social engineering
- Data privacy
- Secure use of technology
- Train employees and leadership teams on cyber risk management.

9. Audit & Assurance

- Coordinate internal and external security audits.
- Manage penetration testing and security assessments.
- Address observations from:
- Internal Audit
- IRDAI inspections
- External auditors
- Regulatory reviews

Key Stakeholders The CISO typically interacts with:

- Board of Directors and Risk Committee
- Chief Technology Officer (CTO)




- Chief Information Officer (CIO)
- Chief Risk Officer (CRO)
- Chief Compliance Officer
- Business Heads
- IRDAI and regulatory bodies
- External auditors and cybersecurity partners

Typical KPIs

- Reduction in cybersecurity incidents
- Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR)
- Vulnerability remediation timelines
- Regulatory compliance score
- Security audit outcomes
- Security awareness effectiveness
- Third-party risk assessment completion rates
- Cyber resilience and disaster recovery readiness

Required Qualifications

Education

- Bachelor's degree in Engineering, Computer Science, Information Technology, or related field.
- Master's degree (MBA/MS) preferred.

Certifications (Preferred)

- CISSP
- CISM
- CRISC
- CCSP
- ISO 27001 Lead Implementer/Lead Auditor
- CEH
- Certified Data Privacy Qualified

Experience

- 15-20 years in Information Security, Cyber Security, Technology Risk, or IT Governance.
- 5-10 years in senior leadership roles.
- Experience in Insurance, BFSI, Banking, or Financial Services preferred.
- Strong understanding of insurance business processes such as underwriting, claims, policy administration, distribution, and digital insurance platforms.

Reporting Structure

Typically reports to

- Chief Risk Officer (CRO),
- Chief Executive Officer (CEO), or
- Board Risk Committee (depending on organizational structure and IRDAI governance requirements).

Expected Competencies

- Strategic leadership
- Cybersecurity governance
- Risk management
- Regulatory compliance
- Incident management
- Stakeholder management
- Communication and Board presentations
- Vendor and contract management
- Business continuity and crisis leadership

Overall objective: To protect the insurer's information assets, customer data, digital platforms, and business operations from cyber threats while enabling secure business growth and regulatory compliance.

Pay: ₹3,500,000.00 - ₹6,000,000.00 per year

Benefits

- Health insurance
- Leave encashment
- Life insurance
- Paid sick time
- Paid time off
- Provident Fund

Work Location: In person

📌 Chief Information Security Officer - General Insurance (Chennai)
🏢 Gravensure General Insurance
📍 Chennai