Key Responsibilities

Vulnerability Management & Engineering Remediation

• Own the end-to-end VAPT remediation lifecycle, from risk-based triage and exploitability assessment through engineering assignment, validation, closure, and reporting.
• Translate penetration-test and vulnerability findings into clear code, configuration, infrastructure, and architecture changes.
• Work directly with application, platform, DevOps, cloud, and infrastructure teams to remove root causes rather than apply temporary policy-level fixes.
• Establish remediation SLAs, exception governance, trend reporting, and escalation mechanisms for material security risks.

Compliance Engineering & Regulatory Readiness

• Engineer and maintain a unified control framework that normalizes requirements across PCI DSS, ISO 27001, RBI mandates, SWIFT CSP, and internal security standards.
• Lead readiness and response programs for RBI requirements, including PAPG, PPI, Network Tokenization, Digital Lending, and relevant technology or cyber-resilience audits.
• Conduct gap assessments, maintain risk registers, define remediation plans, and ensure audit evidence is accurate, complete, and traceable.
• Embed security and compliance gates into product development and change-management lifecycles.

Additional Accountabilities

• Lead technology compliance and audit planning, including scope definition, ownership, evidence strategy, stakeholder communications, and external assessor coordination.
• Oversee vendor security assessments, contract security requirements, and remediation of third-party risks.
• Direct disaster-recovery and business-continuity exercises for critical payment infrastructure; validate RTO/RPO objectives and document outcomes.
• Drive production access reviews, infrastructure hardening, security logging, asset governance, and continuous control monitoring.
• Build security awareness initiatives, including targeted phishing simulations and engineering-focused learning programs.
• Manage, coach, and develop security and compliance engineers; set priorities, allocate work, review quality, and build succession capability.
• Provide concise risk reporting and decision support to senior security, technology, product, legal, and business stakeholders.

Required Qualifications & Experience

• Bachelor's degree in Information Technology, Computer Science, Cybersecurity, Engineering, or a related discipline.
• 8+ years of progressive experience in information security, payment security, cybersecurity consulting, GRC, compliance engineering, or a related field.
• 2+ years of experience leading teams, major workstreams, or cross-functional security programs in a complex technology environment.
• Experience in fintech, payments, banking, financial services, or another highly regulated digital business.
• Proven ability to review technical architectures, challenge control designs, and guide engineers toward implementable security outcomes.
• Experience managing external audits and working with regulators, assessors, QSAs, penetration testers, and third-party vendors.

Technical & Domain Expertise