Overview :We are seeking a hands-on security leader to build and own our data protection and application security function from the ground up. This role reports directly to the CTO and carries a direct mandate to close gaps, enforce standards, and embed proactive security into product and engineering workflows. In fintech, data is the product - protecting it is protecting the business.Responsibilities :Data Leakage Detection & Prevention :- Design and operationalize a comprehensive DLP framework across structured data stores, APIs, SaaS tools, email, and endpoints.- Implement continuous monitoring to detect anomalous queries, bulk exports, unauthorized reads, and privilege abuse in real time.- Own sensitive data classification and enforce access boundaries across storage, application, and transport layers.API & Application Flow Security :- Conduct deep audits of internal and external APIs, reviewing contracts, authentication, and data scopes to identify vulnerabilities (BOLA, excessive exposure, broken auth, etc.).- Walk product flows end-to-end to identify over-exposure, unnecessary retention, and unintended access paths.- Actively participate in threat modelling during SDLC for current features.- Define and enforce API security standards with measurable release pipeline gates.Database & Infrastructure Access Control :- Audit and redesign least-privilege access models across databases and warehouses.- Implement query-level monitoring, data masking in non-production, and tokenisation where applicable.- Ensure defensible, documented access justifications for all data stores.Employee Data Risk & Internal Threat Containment :- Identify and close employee data exfiltration channels (email, cloud sync, SaaS integrations,



removable media).- Deploy technical DLP controls for outbound data movement.- Implement tiered RBAC/ABAC frameworks with regular access reviews.Customer Account & Identity Protection :- Own detection and prevention of account takeover, spoofing, and unauthorized session access.- Review authentication flows, session management, and customer data exposure directly with product and engineering.- Maintain zero-blind-spot ownership of identity vulnerabilities.Risk Reporting & Organisational Influence :- Produce risk-rated findings with business impact context for both technical teams and the board.- Constructively challenge infra, product, engineering, and CISO functions when gaps are identified.- Build a culture of proactive data protection embedded in engineering and product practices.Requirements :Experience :- 10 - 14 years in security, with 4 - 5 years in fintech, payments, banking, or financial data environments.- Hands-on expertise in application security, API security, and data access governance.- Prior experience building a security sub-function from scratch strongly preferred.- Backgrounds may include: Senior AppSec Engineer, Principal Security Architect, Red Team Lead, or senior penetration tester turned internal security leader.Product Mindset & Systems Thinking :- Ability to map complete product flows and identify leakage risks from design decisions.- Skilled at engaging product/engineering teams in their language, framing risks in terms of user impact and system design.- Curiosity-driven approach: asking "why does this system work this way?" before "what CVEs apply here?"Technical Skills :- OWASP API Top 10, DLP tooling,



STRIDE/PASTA threat modelling.- SIEM & detection rules, RBAC/ABAC, OAuth 2.0, JWT security.- Database audit & access control, data masking & tokenisation.- API penetration testing, endpoint DLP, session management.Privileged Access Management :- Strong command of database security, audit logging, and privilege management.- Ability to write meaningful SIEM detection rules and alerting logic.- Solid understanding of IAM, RBAC/ABAC, OAuth 2.0, JWT vulnerabilities, and session security.Regulatory Awareness :- Working knowledge of PCI-DSS, SOC 2, GDPR, and local financial regulations (RBI, MAS, FCA).- Compliance understood as guardrails, not the primary measure of success.Leadership & Influence- Proven ability to drive change across engineering, product, and business teams.- Strong communication skills - translating technical vulnerabilities into board-level risk statements.- Politically resilient, evidence-driven, and ego-free.- Builder mindset: thrives in greenfield environments, leads by doing.The Team You Will Build :You will hire and manage specialists with full ownership of team structure and tooling selection:- API & Application Security Specialist - continuous API auditing, threat modelling, SDLC security gates.- Data Access & Monitoring Specialist - database governance, query monitoring, anomaly detection.- Internal Threat & Employee Risk Analyst - controls for internal data egress, access provisioning reviews.Why Join Us :- Direct mandate from the top - report to the CTO, not into a security hierarchy.- Real authority - findings are acted on, gaps get closed.- Greenfield build - define the function, tools, processes, and team.- Hands-on leadership - lead by doing, not delegating.- Meaningful problem - in fintech, data is the product. Protecting it is protecting the business. (ref:hirist.tech)

📌 Vice President - Data Protection (Bengaluru)
🏢 Dinoxo IT Consulting
📍 Bengaluru