Key Responsibilities:

- Enterprise IT & Infrastructure Leadership

- Own and scale global IT operations — end-user computing, networks, cloud infrastructure, and office IT for a distributed workforce.
- Dogfood our own product stack (ZTNA, MFA, SSO, MDM, virtualization) as the foundation of internal IT architecture — serving as both a validation workplace and a reference implementation for customers.
- Design secure, identity-driven enterprise architecture with conditional access, device posture enforcement, and zero-trust segmentation.
- Drive adoption of zero-trust and least-privilege models across all infrastructure layers.
- Ensure high availability, performance, and resilience of internal systems with defined SLA targets.
- Implement cloud security posture management (CSPM) and cloud workload protection (CWPP) across cloud environments.

2. Security Strategy & Operations
- Define and execute the organization’s information security strategy, aligned to business objectives and the evolving threat landscape.
- Build and lead capabilities across:
- Security operations center (SOC) — with AI-augmented monitoring, detection, and response.
- Vulnerability management and patching with defined SLA-driven remediation timelines.
- Identity and access governance across internal and product environments.
- Establish threat-informed defense models aligned to frameworks like MITRE ATT&CK.;
- Deploy and evolve AI-native security tooling for automated threat detection, anomaly identification, and intelligent alerting to reduce analyst burden and improve response times.

3. AI & Emerging Technology Security
- Own the security governance framework for AI/ML usage across the organization — both internal tools and product-embedded capabilities.
- Address AI-specific threat vectors including:
- LLM-assisted phishing and deepfake-based social engineering.
- Prompt injection, data exfiltration via AI tools, and model manipulation risks.
- Shadow AI usage and ungoverned adoption of generative AI by employees.
- Define acceptable use policies and technical controls for AI tools (e.g., data classification rules for LLM inputs, approved tool lists, access controls for model endpoints).
- Evaluate and integrate AI-driven capabilities into the security operations stack — automated triage, behavioral analytics, predictive threat intelligence.
- Stay current on regulatory developments related to AI governance and data protection (e.g., EU AI Act, emerging regional frameworks).

4. Product & Platform Security
- Partner with engineering to embed secure SDLC practices with security gates at each stage of the development lifecycle.
- Drive security architecture reviews across the product portfolio, with particular focus on:
- Authentication and authorization layers (MFA, SSO, biometric authentication).
- ZTNA and VPN / VDI / workspace access components.
- MDM and endpoint management services.
- Secure OS and USB-based deployment surfaces.
- API and cloud-native services.
- Implement and mature:
- SAST, DAST, SCA, and SBOM practices with automated integration into CI/CD pipelines.
- Threat modeling (STRIDE or equivalent) as a standard practice for new features and architecture changes.
- Own software supply chain security — dependency integrity, build pipeline security, and provenance verification.




- Act as the internal authority on customer-facing product security posture — particularly critical given that our products are themselves security tools evaluated by CISOs and security teams.

5. Data Protection, Privacy & Security (DPO)
- Serve as the organization’s Data Protection Officer (DPO), with accountability for data privacy compliance across all 12 operating countries.
- Define and enforce data classification, data loss prevention (DLP), and encryption strategies (at rest, in transit, and in use) — across products and internal systems.
- Partner with product and engineering to embed privacy-by-design principles, particularly for products handling customer identity and access data.
- Own data protection impact assessments (DPIAs) for new products, features, and data processing activities.
- Ensure alignment between data handling practices and regulatory requirements across all operating geographies (GDPR, India’s DPDP Act, and regional data protection laws).
- Own data retention, anonymization, and cross-border data transfer policies — including standard contractual clauses (SCCs) and binding corporate rules where required.
- Act as the primary point of contact for data protection authorities across jurisdictions.

6. Compliance, Risk & Governance
- Lead and maintain certifications such as ISO/IEC 27001, SOC 2 Type II, and regional regulatory requirements across operating geographies.
- Build audit-ready evidence frameworks — automated where possible — to reduce certification overhead and audit preparation time.
- Manage:
- Risk assessments (enterprise + product) with quantified risk scoring.
- Third-party and vendor risk programs with defined assessment cadence.
- Software supply chain risk as part of the broader vendor and dependency risk posture.
- Multi-country regulatory interactions and customer security reviews.

7. Customer Trust & External Interface
- Represent the company in security due diligence discussions with enterprise customers (CISOs, CIOs, Risk leaders) — with the understanding that as a security vendor, our own posture is scrutinized to a higher standard.
- Own responses to:
- Security questionnaires.
- RFP/RFI security sections.
- Regulatory inquiries.
- Build a trust narrative that positions our internal security practices as proof of our product philosophy — we secure ourselves with the same tools we sell.
- Contribute to sales enablement by reducing security-related friction in enterprise deal cycles across all 12 operating countries.

8. Incident Response & Resilience
- Define and operationalize incident response and crisis management frameworks with clear escalation paths and communication protocols.
- Conduct regular:
- Tabletop exercises with cross-functional participation.
- Red team / blue team simulations (including AI-augmented adversary simulations).
- Ensure alignment between cyber resilience and business continuity / disaster recovery planning.
- Define and track incident response metrics — Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), and Mean Time to Recover.

9. Security Culture & Awareness




- Build and run a security awareness program for 300+ employees across multiple countries — including phishing simulations, role-specific training, and onboarding security modules.
- Establish a developer security champions program to distribute security ownership across engineering teams — especially critical in a company whose products are security tools.
- Foster a culture where security is everyone’s responsibility, not a bottleneck or afterthought.

10. Team & Capability Building
- Inherit and lead an existing team of 10 — 6 in IT Operations and 4 in Security — and grow the function by approximately 20% over the next 12 months (to ~12 people).
- Assess current capabilities, identify gaps, and hire strategically to build depth across security engineering, GRC, product security, and data protection.
- Structure teams across:
- IT Operations
- Security Engineering & Operations
- GRC, Compliance & Data Protection
- Product Security
- Customer Trust & Assurance
- Establish 24x7 readiness where required for enterprise support, with clear on-call structures and escalation protocols.

Experience:

- 12–15 years across IT, security, and infrastructure roles, with a progression from hands-on technical work to building and leading teams.
- Experience as a Manager / Head of Security / IT / Security Architect in a product company (strong preference for security, identity, or infrastructure product companies) or technology-led enterprise environment.
- Strong exposure to regulated industries (BFSI, healthcare, SaaS serving regulated clients).
- Track record of building security programs that directly enabled revenue (shortened deal cycles, won enterprise accounts, achieved certifications that unlocked market segments).
- Experience operating across multiple geographies and regulatory environments is strongly preferred.

Technical Depth

- Identity and access systems (SSO, MFA, IAM, SCIM, directory services, biometric authentication) ideally with experience in organizations that build these products.
- Virtualization and secure workspace technologies (VDI, virtual desktops, thin-client architectures).
- Endpoint and mobile device security (MDM, device posture, zero-trust network access).
- Cloud security CSPM, CWPP, IAM policies, network segmentation across AWS/Azure/GCP.
- AI/ML security governance frameworks, LLM risk management, AI-augmented security operations.
- Software supply chain security SBOM management, dependency scanning, build integrity.
- Secure OS and hardware-rooted security concepts (bootable secure environments, USB-based OS deployment).
- Proficiency with modern security tooling (SIEM/SOAR platforms, EDR, vulnerability scanners, cloud-native security tools).

Security & Risk

- Strong grounding in threat modeling, adversary simulation, vulnerability management with SLA-driven remediation, and incident response and crisis management.
- Hands-on understanding of adversary behavior, attack paths, and AI-enhanced threat vectors.

Compliance, Governance & Data Protection

- Deep familiarity with ISO/IEC 27001, SOC 2 Type II.
- Data protection regulations across multiple jurisdictions (GDPR, India’s DPDP Act, regional equivalents).
- DPO responsibilities — data protection impact assessments, breach notification obligations, cross-border transfer mechanisms (SCCs, adequacy decisions).
- Emerging AI governance frameworks (EU AI Act and equivalents).

📌 Information Technology Security Manager (Maharashtra)
🏢 Accops
📍 Maharashtra