Chief Information Security Officer

TAC Security is a global cybersecurity company helping enterprises understand and reduce cyber risk through risk-based vulnerability management, attack surface management, security assessments, managed security services and cybersecurity consulting.About the RoleWe are looking for a Chief Information Security Officer to lead TAC Security’s information security strategy and strengthen security across our business, products and operations.The CISO will work closely with executive leadership, Engineering, Product, IT and business teams to identify and manage cyber risks, protect company and customer information, and build security practices that support global growth.This is a hands-on leadership role requiring strategic judgment, technical depth and the ability to build practical security programs in a growing cybersecurity company. The CISO will also represent TAC Security in strategic customer conversations and provide executive guidance on cybersecurity matters.Key ResponsibilitiesSecurity Strategy & Executive LeadershipDefine and execute TAC Security’s information security strategy, roadmap and priorities.Establish a security governance model with clear ownership, policies and accountability across functions.Advise the CEO and executive leadership on cyber risks, security investments and business implications.Present security posture, material risks and progress to executive leadership and the Board, as required.Own security budget planning and prioritise investments based on risk and business needs.Enterprise Security & Cyber Risk ManagementLead the protection of company systems, infrastructure, applications and sensitive information.Establish and maintain an enterprise cyber risk register, with mitigation plans and accountable business owners.Oversee identity and access management, endpoint security, cloud security, data protection and vulnerability management.Establish third-party security assessments and manage risks associated with vendors and partners.Define a documented process for risk escalation, exceptions and acceptance by authorised business leaders.Product & Application SecurityPartner with Product and Engineering to embed security into product design and the software development lifecycle.Establish secure development practices, application security testing and remediation expectations.Oversee product security reviews, penetration testing and vulnerability disclosure processes.Strengthen security across cloud environments, APIs and software dependencies.Ensure customer data protection and security commitments are reflected in product and operational practices.Security Operations & Incident ManagementEstablish effective security monitoring, threat detection and incident response capabilities.Define incident response plans, escalation procedures and executive communication protocols.Lead the company’s response to significant cybersecurity incidents.Conduct incident simulations and ensure lessons learned translate into corrective actions.Partner with IT and business leaders on business continuity, disaster recovery and recovery testing.Governance, Compliance & Customer AssuranceOwn the company’s information security policies, standards and control framework.Lead security readiness for relevant certifications, customer assessments and audits.Align the security program with appropriate frameworks such as ISO 27001, NIST CSF and CIS Controls.Partner with Legal and relevant business teams on applicable privacy, regulatory and contractual obligations.Support customer due diligence, security questionnaires and assurance discussions with accurate, evidence-based responses.Customer & Industry EngagementAct as an executive security advisor in strategic customer and partner discussions.Support Sales and Pre-Sales on complex security requirements and customer assurance.Partner with Delivery leadership to define security standards and advise on significant technical risks or incidents.Represent TAC Security at relevant industry forums and executive discussions.Bring customer and market insights into the company’s security and product priorities.Team Leadership & Security CultureBuild and lead the information security function, using internal capabilities and external partners as appropriate.Define team structure, hiring priorities and capability development plans.Develop a company-wide security awareness program tailored to different roles.Coach security professionals and build clear performance expectations.Make security a shared responsibility across the organisation.Required QualificationsBachelor’s degree in Computer Science, Information Security, Engineering or a related field, or equivalent relevant experience.15+ years of relevant cybersecurity experience, including significant experience leading security teams or programs.Experience as a CISO, Deputy CISO, Head of Information Security or equivalent senior security leader.Demonstrated ownership of an organisation’s internal information security strategy and cyber risk program.Strong understanding of cloud security, application security, enterprise security architecture and incident response.Experience establishing security governance, managing audits and supporting customer security assurance.Ability to communicate technical risks clearly to executive leadership and translate them into business decisions.Experience building practical security programs in a technology company or a growing business.Willingness to work on-site in Chandigarh.Preferred QualificationsExperience in cybersecurity products, SaaS or other enterprise technology businesses.Experience supporting a global business and enterprise customers.Experience building or scaling a security function with limited resources.CISSP, CISM, CCISO or CRISC certification.Relevant cloud security or ISO 27001 qualifications.Key CompetenciesStrategic judgment and business acumenCyber risk managementTechnical depth and practical executionExecutive communicationIncident and crisis leadershipCross-functional influenceTeam building and developmentSuccess MeasuresProgress against the agreed security roadmapTimely remediation of critical security risks and vulnerabilitiesEffectiveness of incident detection, response and recoveryClosure of audit findings and control gapsProduct security improvements and adoption of secure development practicesCustomer assurance quality and responsivenessSecurity awareness and adherence across the organisation