Disprz
Senior Security Manager
Chennai · Executive
Recently posted - highest visibilityVerified listingPosted 2h ago
Applicants who checked fit first are 3.1× more likely to hear back
Your match scoreFree · sign in
Your score for this role already exists
ASAI compared this JD against 41 signals - skills, seniority, domain, stack overlap etc. Add a resume and it unlocks in about 30 seconds.
Always free · no credit card · 1 tap with Google
What we know about this role
Hiring pulse
LOW
Our tracked job listings for Disprz show limited recent activity.
Apply window
First 72 hours
Still inside it - posted 2h agoEarly applicants get seen before the pile builds.
Not a repost
The first time we've seen this listing - it hasn't been closed and reopened.
Skills required
22 listedBusiness Continuity And Disaster RecoveryInformation Security Management SystemsSupply Chain SecuritySecurity StrategiesExecutive LeadershipRisk RegisterPenetration TestingInfrastructure Security+14 more
You almost certainly match several of these already. Unlock your skill map to see the matches, the gaps, and what to fix first.
Job description
Senior Security Manager / Director – Information Security
Location: Chennai
Function: Information Security / Cybersecurity
Reporting to: CTO / COO
Experience: 10–18+ years
Industry: SaaS / Enterprise Software / Technology Products
Role Overview
We are looking for a seasoned Information Security leader to build, operate and continuously mature the company's enterprise and product security programme. The individual will perform the responsibilities of a CISO, with ownership across information
security strategy, product security, cloud security, cybersecurity risk, compliance, privacy collaboration, security governance, incident response and customer security assurance. This is a highly visible leadership role requiring close partnership with the Engineering, Product, Cloud/Infrastructure, Legal, Compliance, HR, Sales and Customer Success teams. The successful candidate will be expected to balance security, business enablement and customer trust, rather than treating security purely as a compliance or IT function.
Key Responsibilities
1. Information Security Strategy & Governance
- Define and execute the company's multi-year Information Security and Cybersecurity strategy aligned with business and product objectives.
- Establish and maintain the enterprise Information Security Management System (ISMS).
- Develop security policies, standards, procedures and control frameworks.
- Establish security governance, metrics, KRIs/KPIs and executive reporting.
- Present security posture, material risks, incidents and remediation progress to the executive leadership team and, where required, the Board.
- Maintain an enterprise-wide cybersecurity risk register and drive remediation of material risks.
- Define security architecture and technology principles in partnership with Engineering and IT.
2. Product & Application Security
- Own the Product Security portfolio covering the SaaS platform, web applications, APIs, mobile applications and supporting services.
- Embed security into the SDLC and DevSecOps lifecycle.
- Establish application-security standards covering secure coding, threat modelling, SAST,
- DAST, SCA, API security, secrets management and vulnerability management.
- Establish appropriate penetration testing and application security assessment programmes.
- Partner with Engineering to ensure security vulnerabilities are prioritised and remediated based on business risk.
- Drive security-by-design for new products, features, integrations and architectural changes.
- Establish and maintain Software Supply Chain Security / SBOM practices.
3. Cloud & Infrastructure Security
- Own the security posture of the company's cloud environments and supporting infrastructure.
- Establish cloud security standards covering IAM, network security, encryption, logging, configuration management, workload security and data protection.
- Partner with Cloud/DevOps teams to implement Cloud Security Posture Management and secure infrastructure-as-code practices.
- Ensure appropriate segregation of production, non-production and customer environments.
- Review and approve security aspects of major infrastructure and architectural changes.
4. Security Operations & Incident Response
- Establish and oversee the company's cybersecurity monitoring and detection capabilities.
- Define and maintain an enterprise Incident Response and Cyber Crisis Management framework.
- Lead or coordinate response to significant security incidents, data breaches and cyber events.
- Establish incident severity, escalation and communication protocols.
- Conduct post-incident reviews and ensure corrective actions are implemented.
- Maintain relationships with relevant external security partners, incident-response providers and law-enforcement/regulatory bodies where appropriate.
5. Vulnerability & Risk Management
- Establish an enterprise-wide vulnerability management programme.
- Define risk-based remediation SLAs and exception-management processes.
- Oversee vulnerability identification across applications, infrastructure, cloud environments
- and third-party components.
- Drive periodic security assessments, penetration testing and risk reviews.
- Ensure security risks are tracked through to closure.
6. Compliance & Certifications
- Own and continuously mature the company's security compliance programme, including relevant
- frameworks and standards such as:
- ISO 27001
- SOC 2 Type II
- ISO 42001
- GDPR / applicable data-protection regulations
- India DPDP Act and related requirements
- Customer specific security and regulatory requirements
- Other industry specific frameworks applicable to the company's markets
- Lead internal and external security audits.
- Ensure audit findings are appropriately remediated.
- 21 CFR Part 11 / EU GMP Annex 11 compliance
- Maintain evidence, control ownership and audit readiness throughout the year rather than only during audit periods.
7. Customer Security & Trust
- Own the security component of customer due diligence and enterprise security assessments.
- Partner with Sales, Pre-Sales and Customer Success on security questionnaires, RFPs and customer audits.
- Develop standard security responses, trust documentation and evidence repositories.
- Participate in strategic customer meetings involving cybersecurity, privacy, compliance and risk.
- Establish a scalable mechanism for responding to customer security requirements without creating unnecessary engineering overhead.
- Support the development and maintenance of customer-facing security/trust documentation.
8. Data Protection & Privacy Collaboration
- Partner closely with the DPO / Legal / Privacy function on information-security aspects of privacy compliance.
- Support DPIAs, data-processing assessments and privacy-by-design initiatives.
- Ensure security controls support applicable data retention, deletion, access and breach- notification requirements.
9. Business Continuity & Resilience
- Own cybersecurity aspects of Business Continuity and Disaster Recovery.
- Establish recovery objectives and security requirements for critical SaaS services.
- Conduct periodic DR, cyber-resilience and crisis simulations.
- Ensure backup, recovery and resilience controls are appropriately protected against cyber threats such as ransomware.
- Partner with Engineering/Infrastructure teams to validate recovery capability.
10. Third-Party & Supply-Chain Security
- Establish a risk-based Third-Party Risk Management programme.
- Assess security posture of critical vendors, SaaS providers, cloud providers and technology partners.
- Define security requirements for vendor onboarding and contracting.
- Conduct periodic reassessment of critical suppliers.
- Establish appropriate security clauses, audit rights and breach-notification requirements in collaboration with Legal.
11. Security Awareness & Culture
- Establish an organisation-wide security awareness programme.
- Conduct phishing simulations, secure-development training and role-specific security raining.
- Build a culture where security is considered a shared responsibility across Engineering,
- Product, IT and business teams.
- Establish security champions within engineering/product teams.
12. Emerging Technology & AI Security
- Establish security governance for the company's adoption of Generative AI, AI agents, LLMs and other emerging technologies.
- Assess risks associated with AI-enabled product features and internal AI usage.
- Define controls for data leakage, model access, prompt injection, supply-chain risks and inappropriate use of sensitive information.
- Partner with Product, Engineering, Legal and Privacy teams on responsible and secure AI adoption.
Candidate Profile
Essential
- 10–18+ years of experience in Information Security / Cybersecurity.
- Significant experience in a SaaS, cloud, technology product or enterprise software environment.
- Demonstrated ownership of an enterprise-wide security programme.
- Strong understanding of both Product Security and Enterprise Information Security.
- Experience with ISO 27001, SOC 2 and GDPR.
- Strong understanding of cloud security, preferably across AWS and/or Azure.
- Strong application-security and DevSecOps understanding.
- Experience managing security incidents and cyber-risk programmes.
- Experience interacting with enterprise customers on security assessments.
- Strong understanding of security governance, risk and compliance.
- Demonstrated ability to influence senior Engineering, Product and Business leaders.
- Exposure to AI security / AI governance.
Preferred
- CISSP / CISM / CCSP / CRISC or equivalent.
- Experience taking a SaaS company through SOC 2 / ISO 27001 certification and subsequent maturation.
- Experience with GDPR / DPDP and international privacy requirements.
- Experience with enterprise customer security audits.
- Experience with security architecture and threat modelling.
- Experience with SBOM / software supply-chain security.
- Prior experience as CISO, Deputy CISO, Head of Information Security, Director – Information
- Security or Associate Director – Information Security.
Tools to land this role
PremiumYour match score, skill map and tracker stay free.
Ground Reality
PremiumInsider Path
PremiumFree · no signup
Get tomorrow's jobs before you have to search
Daily job drops, skill trends and free resources - posted straight to the group. Leave any time.
No spam. Just jobs and resources.
Why people use ASAI
Someone shared one job with you. ASAI keeps finding the rest.
Scored, not searched. Every role ranked against your actual profile.
Alerts as often as hourly. Reach new roles while the pile is still small.
Skill gaps, spelled out. See exactly which requirements you don't meet yet.
Verified jobs, only. Say no to ghost jobs. Your time deserves respect.
More Security Engineer roles in Chennai
See allKeep browsing