Senior Security Manager
Operations
Chennai, Tamil Nadu, India
Posted on Oct 12, 2026
Senior Security Manager / Director – Information Security
Location: Chennai
Function: Information Security / Cybersecurity
Reporting to: CTO / COO
Experience: 10–18+ years
Industry: SaaS / Enterprise Software / Technology Products
Role Overview
We are looking for a seasoned Information Security leader to build, operate and continuously mature the company's enterprise and product security programme. The individual will perform the responsibilities of a CISO, with ownership across information
security strategy, product security, cloud security, cybersecurity risk, compliance, privacy collaboration, security governance, incident response and customer security assurance. This is a highly visible leadership role requiring close partnership with the Engineering, Product, Cloud/Infrastructure, Legal, Compliance, HR, Sales and Customer Success teams. The successful candidate will be expected to balance security, business enablement and customer trust, rather than treating security purely as a compliance or IT function.
Key Responsibilities
1. Information Security Strategy & Governance
- Define and execute the company's multi-year Information Security and Cybersecurity strategy aligned with business and product objectives.
- Establish and maintain the enterprise Information Security Management System (ISMS).
- Develop security policies, standards, procedures and control frameworks.
- Establish security governance, metrics, KRIs/KPIs and executive reporting.
- Present security posture, material risks, incidents and remediation progress to the executive leadership team and, where required, the Board.
- Maintain an enterprise-wide cybersecurity risk register and drive remediation of material risks.
- Define security architecture and technology principles in partnership with Engineering and IT.
2. Product & Application Security
- Own the Product Security portfolio covering the SaaS platform, web applications, APIs, mobile applications and supporting services.
- Embed security into the SDLC and DevSecOps lifecycle.
- Establish application-security standards covering secure coding, threat modelling, SAST,
- DAST, SCA, API security, secrets management and vulnerability management.
- Establish appropriate penetration testing and application security assessment programmes.
- Partner with Engineering to ensure security vulnerabilities are prioritised and remediated based on business risk.
- Drive security-by-design for new products, features, integrations and architectural changes.
- Establish and maintain Software Supply Chain Security / SBOM practices.
3. Cloud & Infrastructure Security
- Own the security posture of the company's cloud environments and supporting infrastructure.
- Establish cloud security standards covering IAM, network security, encryption, logging, configuration management, workload security and data protection.
- Partner with Cloud/DevOps teams to implement Cloud Security Posture Management and secure infrastructure-as-code practices.
- Ensure appropriate segregation of production, non-production and customer environments.
- Review and approve security aspects of major infrastructure and architectural changes.
4. Security Operations & Incident Response
- Establish and oversee the company's cybersecurity monitoring and detection capabilities.
- Define and maintain an enterprise Incident Response and Cyber Crisis Management framework.
- Lead or coordinate response to significant security incidents, data breaches and cyber events.
- Establish incident severity, escalation and communication protocols.
- Conduct post-incident reviews and ensure corrective actions are implemented.
- Maintain relationships with relevant external security partners, incident-response providers and law-enforcement/regulatory bodies where appropriate.
5. Vulnerability & Risk Management
- Establish an enterprise-wide vulnerability management programme.
- Define risk-based remediation SLAs and exception-management processes.
- Oversee vulnerability identification across applications, infrastructure, cloud environments
- and third-party components.
- Drive periodic security assessments, penetration testing and risk reviews.
- Ensure security risks are tracked through to closure.
6. Compliance & Certifications
- Own and continuously mature the company's security compliance programme, including relevant
- frameworks and standards such as:
- ISO 27001
- SOC 2 Type II
- ISO 42001
- GDPR / applicable data-protection regulations
- India DPDP Act and related requirements
- Customer specific security and regulatory requirements
- Other industry specific frameworks applicable to the company's markets
- Lead internal and external security audits.
- Ensure audit findings are appropriately remediated.
- 21 CFR Part 11 / EU GMP Annex 11 compliance
- Maintain evidence, control ownership and audit readiness throughout the year rather than only during audit periods.
7. Customer Security & Trust
- Own the security component of customer due diligence and enterprise security assessments.
- Partner with Sales, Pre-Sales and Customer Success on security questionnaires, RFPs and customer audits.
- Develop standard security responses, trust documentation and evidence repositories.
- Participate in strategic customer meetings involving cybersecurity, privacy, compliance and risk.
- Establish a scalable mechanism for responding to customer security requirements without creating unnecessary engineering overhead.
- Support the development and maintenance of customer-facing security/trust documentation.
8. Data Protection & Privacy Collaboration
- Partner closely with the DPO / Legal / Privacy function on information-security aspects of privacy compliance.
- Support DPIAs, data-processing assessments and privacy-by-design initiatives.
- Ensure security controls support applicable data retention, deletion, access and breach- notification requirements.
9. Business Continuity & Resilience
- Own cybersecurity aspects of Business Continuity and Disaster Recovery.
- Establish recovery objectives and security requirements for critical SaaS services.
- Conduct periodic DR, cyber-resilience and crisis simulations.
- Ensure backup, recovery and resilience controls are appropriately protected against cyber threats such as ransomware.
- Partner with Engineering/Infrastructure teams to validate recovery capability.
10. Third-Party & Supply-Chain Security
- Establish a risk-based Third-Party Risk Management programme.
- Assess security posture of critical vendors, SaaS providers, cloud providers and technology partners.
- Define security requirements for vendor onboarding and contracting.
- Conduct periodic reassessment of critical suppliers.
- Establish appropriate security clauses, audit rights and breach-notification requirements in collaboration with Legal.
11. Security Awareness & Culture
- Establish an organisation-wide security awareness programme.
- Conduct phishing simulations, secure-development training and role-specific security raining.
- Build a culture where security is considered a shared responsibility across Engineering,
- Product, IT and business teams.
- Establish security champions within engineering/product teams.
12. Emerging Technology & AI Security
- Establish security governance for the company's adoption of Generative AI, AI agents, LLMs and other emerging technologies.
- Assess risks associated with AI-enabled product features and internal AI usage.
- Define controls for data leakage, model access, prompt injection, supply-chain risks and inappropriate use of sensitive information.
- Partner with Product, Engineering, Legal and Privacy teams on responsible and secure AI adoption.
Candidate Profile
Essential
- 10–18+ years of experience in Information Security / Cybersecurity.
- Significant experience in a SaaS, cloud, technology product or enterprise software environment.
- Demonstrated ownership of an enterprise-wide security programme.
- Strong understanding of both Product Security and Enterprise Information Security.
- Experience with ISO 27001, SOC 2 and GDPR.
- Strong understanding of cloud security, preferably across AWS and/or Azure.
- Strong application-security and DevSecOps understanding.
- Experience managing security incidents and cyber-risk programmes.
- Experience interacting with enterprise customers on security assessments.
- Strong understanding of security governance, risk and compliance.
- Demonstrated ability to influence senior Engineering, Product and Business leaders.
- Exposure to AI security / AI governance.
Preferred
- CISSP / CISM / CCSP / CRISC or equivalent.
- Experience taking a SaaS company through SOC 2 / ISO 27001 certification and subsequent maturation.
- Experience with GDPR / DPDP and international privacy requirements.
- Experience with enterprise customer security audits.
- Experience with security architecture and threat modelling.
- Experience with SBOM / software supply-chain security.
- Prior experience as CISO, Deputy CISO, Head of Information Security, Director – Information
- Security or Associate Director – Information Security.