Chief Information Security Officer

Chief Information Security Officer (CISO) - AGM is responsible for overseeing the overall information security strategy of the organization and is entrusted with the responsibility of developing, implementing and monitoring a strategic and comprehensive enterprise-wide information security and IT risk management.Mandatory: Minimum 5+ years of experience in IT/ Information Security, with at least 2 years in a senior leadership role (CISO / Deputy CISO / Head of Information Security).Knowledge & Competence Areas:The candidate should demonstrate expertise and leadership-level understanding of IT Governance, Risk & Compliance:IT Act, Digital Personal Data Protection (DPDP) Act and associated rules thereunder, IRDAI and other Regulatory Guidelines, CERT-In cyber security circulars and RBI guidelines.Regulatory and Compliance Responsibilities:Coordinate with regulatory and intelligence agencies including RBI, NABARD, IRDAI, and CERT-In CSITE for information sharing and compliance.Coordination with departments in NABFINS for the regulatory compliance.Ensure compliance with the IT Act, Digital Personal Data Protection (DPDP) Act, IRDAI Cybersecurity Guidelines, and other domestic and international standards.Liaise with the Company’s Legal and Compliance teams to interpret regulatory updates and ensure timely security control alignment.Lead the development and maintenance of the organizational Data Governance framework, policies, and standards related to data classification, retention, and access controls.Oversee the resolution of audit observations and inspection findings from regulators, statutory auditors, and internal/external agencies.Coordination with the internal/external auditors aligned for IT audits such as Information Security audit, Vulnerability assessment and penetration test, Insurance Regulatory and Development Authority of India audit, RBI audit, and NABARD auditAdvisory and Reporting Responsibilities:Oversee the design and delivery of information security awareness and training programs for employees, vendors, and senior management, ensuring relevance, effectiveness, and compliance with regulatory requirements.Regularly brief top management, Risk Management Committee and the Board Risk/IT Committee on cyber security posture, risks, compliance, and initiatives.Preparation of agendas and presentation to the Board / IT committee.Oversee the development and ensure presentation of executive dashboards and key metrics on risk, compliance, incident management, and overall security posture to senior management, Board and ITSCB.Represent the Company in industry forums, regulatory committees, and technical conferences on information and cyber security.Advise leadership on emerging global threats, vulnerabilities, and recommended actions to strengthen the Company’s resilience.Ensure transparent communication with stakeholders (internal and external) during cyber incidents as per crisis communication protocols.Candidate must be well versed in:Cyber Risk ManagementInformation Security Risk ManagementThird-Party Risk, Supply Chain SecurityCyber InsuranceRisk QuantificationSIEM and SOC operationsIncident detection and Response (EDR)Threat IntelligenceIdentity and Access Management (IAM)Privilege access management (PAM)Network Access Control (NAC)Zero Trust Architecture (ZTA)Cloud Application & Infrastructure SecurityCloud SecurityVirtualizationSecure Software Development Life Cycle (SDLC)Development, Security, and Operations (DevSecOps)API SecurityData Protection & ResilienceData SecurityDLP (Data Loss Prevention)Security TestingDR & BCPCrisis ManagementEmerging Security PracticesAI/ML in threat detectionSecurity AutomationAdvanced Threat Hunting.CISO – Roles and responsibilitiesReview the information and Cyber security posture of the companyIdentify the gaps in Cyber security and escalate the same to DITPresent agendas on Cyber security related aspects to the Board/Committees of the BoardConduct enterprise-wide cyber risk assessment for NABFINS across branches, HO, applications in use, etc.Classification of risks identified and extending support to the Internal IT Team to ensure that the identified security control gaps are understood and duly remediatedCoordinating for conduct of Information Security Committee (ISC) meetingsConduct cyber security awareness trainings to employeesCoordinating the conduct cyber resilience activities across the organizationIncident Management - Lead strategic response to information security incidents and provide post-event analysesPreparation of detailed RCADrafting the response to queries raised by RegulatorsRegular and adhoc reporting through regulatory portalsCoordinate the conduct of IS Audit, VAPT etc.Devise Frameworks for IS Audits and VAPTCoordinate with DIT for resolution of the issues identified during IS Audit/VAPTDraft the compliance to VAPT, IS Audit observationsAnnual review of all IT Policies for their adequacy and identify implementation gaps, if anyEnsure compliance to internal policies as well as Legal and Regulatory Guidelines (RBI, IRDAI) pertaining to ITDefine Key Risk Indicators (KRI) for monitoring cyber security resilienceCollaborate with CTO/CIO to create and implement enterprise-wide disaster recovery plansNegotiate contracts with vendors and service providers for installing security products and servicesRecognize the emerging technology trends and ensure cybersecurity controls are implemented to secure the ever-changing landscapeExplore latest tools for cyber resilience and inform the Management of their relevance, feasibility etc.Revision of policies related to Information Technology (IT) and Information Security (IS) and presentation to Board and ITSCB.QualificationsShould be qualified with at least two of the following certificationsCISA (Certified Information Systems Auditor)CISSP (Certified Information Systems Security Professional)CISM (Certified Information Security Manager)CEH (Certified Ethical Hacker)Proven experience as a CISO or similar role in information security management and cybersecurity for at least 2 yearsORExperience in working on Information Security or Cyber Security domains for at least 5 yearsGraduation – Preferably: Degree in Engineering, Computer Science/Information Technology or its equivalent.Experience and Knowledge of Security best practices across IT domains (Infrastructure, Application, Enterprise architecture etc.)Robust experience of designing and deploying security solutionsGood knowledge of the IT Regulatory Framework which NABFINS is bound to follow.Should have experience in Cyber Incidence Response and Co-ordination.Please email your resume to nandish.m@nabfins.org along with your current CTC