Role Overview

• Internal IT and infrastructure
• Security engineering and operations
• AI and emerging technology security
• Data protection and privacy (DPO)
• Compliance and certification programs
• Product and platform security
• Customer and regulator-facing security posture

Key Responsibilities

1. Enterprise IT & Infrastructure Leadership

• Own and scale global IT operations — end-user computing, networks, cloud infrastructure, and office IT for a distributed workforce.
• Dogfood our own product stack (ZTNA, MFA, SSO, MDM, virtualization) as the foundation of internal IT architecture — serving as both a validation environment and a reference implementation for customers.
• Design secure, identity-driven enterprise architecture with conditional access, device posture enforcement, and zero-trust segmentation.
• Drive adoption of zero-trust and least-privilege models across all infrastructure layers.
• Ensure high availability, performance, and resilience of internal systems with defined SLA targets.
• Implement cloud security posture management (CSPM) and cloud workload protection (CWPP) across cloud environments.

2. Security Strategy & Operations

• Define and execute the organization’s information security strategy, aligned to business objectives and the evolving threat landscape.
• Build and lead capabilities across:
• Security operations center (SOC) — with AI-augmented monitoring, detection, and response.
• Vulnerability management and patching with defined SLA-driven remediation timelines.
• Identity and access governance across internal and product environments.
• Establish threat-informed defense models aligned to frameworks like MITRE ATT&CK.
• Deploy and evolve AI-native security tooling for automated threat detection, anomaly identification, and intelligent alerting to reduce analyst burden and improve response times.

3. AI & Emerging Technology Security

• Own the security governance framework for AI/ML usage across the organization — both internal tools and product-embedded capabilities.
• Address AI-specific threat vectors including:
• LLM-assisted phishing and deepfake-based social engineering.
• Prompt injection, data exfiltration via AI tools, and model manipulation risks.
• Shadow AI usage and ungoverned adoption of generative AI by employees.
• Define acceptable use policies and technical controls for AI tools (e.g., data classification rules for LLM inputs, approved tool lists, access controls for model endpoints).
• Evaluate and integrate AI-driven capabilities into the security operations stack — automated triage, behavioral analytics, predictive threat intelligence.
• Stay current on regulatory developments related to AI governance and data protection (e.g., EU AI Act, emerging regional frameworks).

4. Product & Platform Security

• Partner with engineering to embed secure SDLC practices with security gates at each stage of the development lifecycle.
• Drive security architecture reviews across the product portfolio, with particular focus on:
• Authentication and authorization layers (MFA, SSO, biometric authentication).
• ZTNA and VPN / VDI / workspace access components.
• MDM and endpoint management services.
• Secure OS and USB-based deployment surfaces.
• API and cloud-native services.
• Implement and mature:
• SAST, DAST, SCA, and SBOM practices with automated integration into CI/CD pipelines.
• Threat modeling (STRIDE or equivalent) as a standard practice for new features and architecture changes.
• Own software supply chain security — dependency integrity, build pipeline security, and provenance verification.
• Act as the internal authority on customer-facing product security posture — particularly critical given that our products are themselves security tools evaluated by CISOs and security teams.

5. Data Protection, Privacy & Security (DPO)

• Serve as the organization’s Data Protection Officer (DPO), with accountability for data privacy compliance across all 12 operating countries.
• Define and enforce data classification, data loss prevention (DLP), and encryption strategies (at rest, in transit, and in use) — across products and internal systems.
• Partner with product and engineering to embed privacy-by-design principles, particularly for products handling customer identity and access data.
• Own data protection impact assessments (DPIAs) for new products, features, and data processing activities.
• Ensure alignment between data handling practices and regulatory requirements across all operating geographies (GDPR, India’s DPDP Act, and regional data protection laws).
• Own data retention, anonymization, and cross-border data transfer policies — including standard contractual clauses (SCCs) and binding corporate rules where required.
• Act as the primary point of contact for data protection authorities across jurisdictions.

6. Compliance, Risk & Governance

• Lead and maintain certifications such as ISO/IEC 27001, SOC 2 Type II, and regional regulatory requirements across operating geographies.
• Build audit-ready evidence frameworks — automated where possible — to reduce certification overhead and audit preparation time.
• Manage:
• Risk assessments (enterprise + product) with quantified risk scoring.
• Third-party and vendor risk programs with defined assessment cadence.
• Software supply chain risk as part of the broader vendor and dependency risk posture.
• Multi-country regulatory interactions and customer security reviews.

7. Customer Trust & External Interface

• Represent the company in security due diligence discussions with enterprise customers (CISOs, CIOs, Risk leaders) — with the understanding that as a security vendor, our own posture is scrutinized to a higher standard.
• Own responses to:
• Security questionnaires.
• RFP/RFI security sections.
• Regulatory inquiries.
• Build a trust narrative that positions our internal security practices as proof of our product philosophy — we secure ourselves with the same tools we sell.
• Contribute to sales enablement by reducing security-related friction in enterprise deal cycles across all 12 operating countries.

8. Incident Response & Resilience

• Define and operationalize incident response and crisis management frameworks with clear escalation paths and communication protocols.
• Conduct regular:
• Tabletop exercises with cross-functional participation.
• Red team / blue team simulations (including AI-augmented adversary simulations).
• Ensure alignment between cyber resilience and business continuity / disaster recovery planning.
• Define and track incident response metrics — Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), and Mean Time to Recover.

9. Security Culture & Awareness

• Build and run a security awareness program for 300+ employees across multiple countries — including phishing simulations, role-specific training, and onboarding security modules.
• Establish a developer security champions program to distribute security ownership across engineering teams — especially critical in a company whose products are security tools.
• Foster a culture where security is everyone’s responsibility, not a bottleneck or afterthought.

10. Team & Capability Building

• Inherit and lead an existing team of 10 — 6 in IT Operations and 4 in Security — and grow the function by approximately 20% over the next 12 months (to ~12 people).
• Assess current capabilities, identify gaps, and hire strategically to build depth across security engineering, GRC, product security, and data protection.
• Structure teams across:
• IT Operations
• Security Engineering & Operations
• GRC, Compliance & Data Protection
• Product Security
• Customer Trust & Assurance
• Establish 24x7 readiness where required for enterprise support, with clear on-call structures and escalation protocols.

What We’re Looking For

Experience

• 12–15 years across IT, security, and infrastructure roles, with a progression from hands-on technical work to building and leading teams.
• Experience as a Manager / Head of Security / IT / Security Architect in a product company (strong preference for security, identity, or infrastructure product companies) or technology-led enterprise environment.
• Strong exposure to regulated industries (BFSI, healthcare, SaaS serving regulated clients).
• Track record of building security programs that directly enabled revenue (shortened deal cycles, won enterprise accounts, achieved certifications that unlocked market segments).
• Experience operating across multiple geographies and regulatory environments is strongly preferred.

Core Competencies

• Identity and access systems (SSO, MFA, IAM, SCIM, directory services, biometric authentication) — ideally with experience in organizations that build these products.
• Virtualization and secure workspace technologies (VDI, virtual desktops, thin-client architectures).
• Endpoint and mobile device security (MDM, device posture, zero-trust network access).
• Cloud security — CSPM, CWPP, IAM policies, network segmentation across AWS/Azure/GCP.
• AI/ML security — governance frameworks, LLM risk management, AI-augmented security operations.
• Software supply chain security — SBOM management, dependency scanning, build integrity.
• Secure OS and hardware-rooted security concepts (bootable secure environments, USB-based OS deployment).
• Proficiency with modern security tooling (SIEM/SOAR platforms, EDR, vulnerability scanners, cloud-native security tools).

• Strong grounding in threat modeling, adversary simulation, vulnerability management with SLA-driven remediation, and incident response and crisis management.
• Hands-on understanding of adversary behavior, attack paths, and AI-enhanced threat vectors.

• Deep familiarity with ISO/IEC 27001, SOC 2 Type II.
• Data protection regulations across multiple jurisdictions (GDPR, India’s DPDP Act, regional equivalents).
• DPO responsibilities — data protection impact assessments, breach notification obligations, cross-border transfer mechanisms (SCCs, adequacy decisions).
• Emerging AI governance frameworks (EU AI Act and equivalents).

• Build teams from early-stage to scale — hiring, structuring, and developing talent while staying hands-on where needed.
• Operate as a builder-operator: comfortable rolling up sleeves on architecture and incident response while simultaneously managing team growth and organizational design.
• Influence engineering and product teams without direct authority.
• Interface with CXOs and external stakeholders (customers, regulators, auditors) across multiple geographies.
• Communicate security risk in business terms — translating technical exposure into revenue, reputation, and operational impact.