Overview:

We are seeking a hands-on security leader to build and own our data protection and application security function from the ground up. This role reports directly to the CTO and carries a direct mandate to close gaps, enforce standards, and embed proactive security into product and engineering workflows. In fintech, data is the product protecting it is protecting the business.

Responsibilities:

Data Leakage Detection & Prevention

- Design and operationalize a comprehensive DLP framework across structured data stores, APIs, SaaS tools, email, and endpoints.
- Implement continuous monitoring to detect anomalous queries, bulk exports, unauthorized reads, and privilege abuse in real time.
- Own sensitive data classification and enforce access boundaries across storage, application, and transport layers.

API & Application Flow Security

- Conduct deep audits of internal and external APIs, reviewing contracts, authentication, and data scopes to identify vulnerabilities (BOLA, excessive exposure, broken auth, etc.).
- Walk product flows end-to-end to identify over-exposure, unnecessary retention, and unintended access paths.
- Actively participate in threat modelling during SDLC for current features.
- Define and enforce API security standards with measurable release pipeline gates.

Database & Infrastructure Access Control

- Audit and redesign least-privilege access models across databases and warehouses.
- Implement query-level monitoring, data masking in non-production, and tokenisation where applicable.
- Ensure defensible, documented access justifications for all data stores.

Employee Data Risk & Internal Threat Containment

- Identify and close employee data exfiltration channels (email, cloud sync, SaaS integrations, removable media).
- Deploy technical DLP controls for outbound data movement.
- Implement tiered RBAC/ABAC frameworks with regular access reviews.

Customer Account & Identity Protection





- Own detection and prevention of account takeover, spoofing, and unauthorized session access.
- Review authentication flows, session management, and customer data exposure directly with product and engineering.
- Maintain zero-blind-spot ownership of identity vulnerabilities.

Risk Reporting & Organisational Influence

- Produce risk-rated findings with business impact context for both technical teams and the board.
- Constructively challenge infra, product, engineering, and CISO functions when gaps are identified.
- Build a culture of proactive data protection embedded in engineering and product practices.

Requirements:

Experience

- 10 - 14 years in security, with 45 years in fintech, payments, banking, or financial data environments.
- Hands-on expertise in application security, API security, and data access governance.
- Prior experience building a security sub-function from scratch strongly preferred.
- Backgrounds may include: Senior AppSec Engineer, Principal Security Architect, Red Team Lead, or senior penetration tester turned internal security leader.

Product Mindset & Systems Thinking

- Ability to map complete product flows and identify leakage risks from design decisions.
- Skilled at engaging product/engineering teams in their language, framing risks in terms of user impact and system design.
- Curiosity-driven approach: asking “why does this system work this way?” before “what CVEs apply here?”

Technical Skills

- OWASP API Top 10, DLP tooling, STRIDE/PASTA threat modelling.




- SIEM & detection rules, RBAC/ABAC, OAuth 2.0, JWT security.
- Database audit & access control, data masking & tokenisation.
- API penetration testing, endpoint DLP, session management.

Privileged Access Management

- Strong command of database security, audit logging, and privilege management.
- Ability to write meaningful SIEM detection rules and alerting logic.
- Solid understanding of IAM, RBAC/ABAC, OAuth 2.0, JWT vulnerabilities, and session security.

Regulatory Awareness

- Working knowledge of PCI-DSS, SOC 2, GDPR, and local financial regulations (RBI, MAS, FCA).
- Compliance understood as guardrails, not the primary measure of success.

Leadership & Influence

- Proven ability to drive change across engineering, product, and business teams.
- Strong communication skills — translating technical vulnerabilities into board-level risk statements.
- Politically resilient, evidence-driven, and ego-free.
- Builder mindset: thrives in greenfield environments, leads by doing.

The Team You Will Build: You will hire and manage specialists with full ownership of team structure and tooling selection:

- API & Application Security Specialist — continuous API auditing, threat modelling, SDLC security gates.
- Data Access & Monitoring Specialist — database governance, query monitoring, anomaly detection.
- Internal Threat & Employee Risk Analyst — controls for internal data egress, access provisioning reviews.

Why Join Us:

- Direct mandate from the top — report to the CTO, not into a security hierarchy.
- Real authority — findings are acted on, gaps get closed.
- Greenfield build — define the function, tools, processes, and team.
- Hands-on leadership — lead by doing, not delegating.
- Meaningful problem — in fintech, data is the product. Protecting it is protecting the business

📌 Vice President - Data Protection (Bengaluru)
🏢 Krazy Bee Services
📍 Bengaluru