Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 11 days ago

Senior Security Manager

Disprz5 open roles

Where
Chennai
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowSenior Security ManagerDisprz · Chennai

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on Disprz's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

11.9% of postings close within 7 days. Measured by our own scanner across the market.

Share of postings closed within
  1. 2.1%1 day
  2. 4.4%3 days
  3. 11.9%7 days
  4. 18.6%14 days
  5. 35.6%30 days
  6. 45.1%60 days
This job: posted 11 days ago

The posting

Senior Security Manager / Director – Information Security

Location: Chennai

Function: Information Security / Cybersecurity

Reporting to: CTO / COO

Experience: 10–18+ years

Industry: SaaS / Enterprise Software / Technology Products

Role Overview

We are looking for a seasoned Information Security leader to build, operate and continuously mature the company's enterprise and product security programme. The individual will perform the responsibilities of a CISO, with ownership across information

security strategy, product security, cloud security, cybersecurity risk, compliance, privacy collaboration, security governance, incident response and customer security assurance. This is a highly visible leadership role requiring close partnership with the Engineering, Product, Cloud/Infrastructure, Legal, Compliance, HR, Sales and Customer Success teams. The successful candidate will be expected to balance security, business enablement and customer trust, rather than treating security purely as a compliance or IT function.

Key Responsibilities

1. Information Security Strategy & Governance

  • Define and execute the company's multi-year Information Security and Cybersecurity strategy aligned with business and product objectives.
  • Establish and maintain the enterprise Information Security Management System (ISMS).
  • Develop security policies, standards, procedures and control frameworks.
  • Establish security governance, metrics, KRIs/KPIs and executive reporting.
  • Present security posture, material risks, incidents and remediation progress to the executive leadership team and, where required, the Board.
  • Maintain an enterprise-wide cybersecurity risk register and drive remediation of material risks.
  • Define security architecture and technology principles in partnership with Engineering and IT.

2. Product & Application Security

  • Own the Product Security portfolio covering the SaaS platform, web applications, APIs, mobile applications and supporting services.
  • Embed security into the SDLC and DevSecOps lifecycle.
  • Establish application-security standards covering secure coding, threat modelling, SAST,
  • DAST, SCA, API security, secrets management and vulnerability management.
  • Establish appropriate penetration testing and application security assessment programmes.
  • Partner with Engineering to ensure security vulnerabilities are prioritised and remediated based on business risk.
  • Drive security-by-design for new products, features, integrations and architectural changes.
  • Establish and maintain Software Supply Chain Security / SBOM practices.

3. Cloud & Infrastructure Security

  • Own the security posture of the company's cloud environments and supporting infrastructure.
  • Establish cloud security standards covering IAM, network security, encryption, logging, configuration management, workload security and data protection.
  • Partner with Cloud/DevOps teams to implement Cloud Security Posture Management and secure infrastructure-as-code practices.
  • Ensure appropriate segregation of production, non-production and customer environments.
  • Review and approve security aspects of major infrastructure and architectural changes.

4. Security Operations & Incident Response

  • Establish and oversee the company's cybersecurity monitoring and detection capabilities.
  • Define and maintain an enterprise Incident Response and Cyber Crisis Management framework.
  • Lead or coordinate response to significant security incidents, data breaches and cyber events.
  • Establish incident severity, escalation and communication protocols.
  • Conduct post-incident reviews and ensure corrective actions are implemented.
  • Maintain relationships with relevant external security partners, incident-response providers and law-enforcement/regulatory bodies where appropriate.

5. Vulnerability & Risk Management

  • Establish an enterprise-wide vulnerability management programme.
  • Define risk-based remediation SLAs and exception-management processes.
  • Oversee vulnerability identification across applications, infrastructure, cloud environments
  • and third-party components.
  • Drive periodic security assessments, penetration testing and risk reviews.
  • Ensure security risks are tracked through to closure.

6. Compliance & Certifications

  • Own and continuously mature the company's security compliance programme, including relevant
  • frameworks and standards such as:
  • ISO 27001
  • SOC 2 Type II
  • ISO 42001
  • GDPR / applicable data-protection regulations
  • India DPDP Act and related requirements
  • Customer specific security and regulatory requirements
  • Other industry specific frameworks applicable to the company's markets
  • Lead internal and external security audits.
  • Ensure audit findings are appropriately remediated.
  • 21 CFR Part 11 / EU GMP Annex 11 compliance
  • Maintain evidence, control ownership and audit readiness throughout the year rather than only during audit periods.

7. Customer Security & Trust

  • Own the security component of customer due diligence and enterprise security assessments.
  • Partner with Sales, Pre-Sales and Customer Success on security questionnaires, RFPs and customer audits.
  • Develop standard security responses, trust documentation and evidence repositories.
  • Participate in strategic customer meetings involving cybersecurity, privacy, compliance and risk.
  • Establish a scalable mechanism for responding to customer security requirements without creating unnecessary engineering overhead.
  • Support the development and maintenance of customer-facing security/trust documentation.

8. Data Protection & Privacy Collaboration

  • Partner closely with the DPO / Legal / Privacy function on information-security aspects of privacy compliance.
  • Support DPIAs, data-processing assessments and privacy-by-design initiatives.
  • Ensure security controls support applicable data retention, deletion, access and breach- notification requirements.

9. Business Continuity & Resilience

  • Own cybersecurity aspects of Business Continuity and Disaster Recovery.
  • Establish recovery objectives and security requirements for critical SaaS services.
  • Conduct periodic DR, cyber-resilience and crisis simulations.
  • Ensure backup, recovery and resilience controls are appropriately protected against cyber threats such as ransomware.
  • Partner with Engineering/Infrastructure teams to validate recovery capability.

10. Third-Party & Supply-Chain Security

  • Establish a risk-based Third-Party Risk Management programme.
  • Assess security posture of critical vendors, SaaS providers, cloud providers and technology partners.
  • Define security requirements for vendor onboarding and contracting.
  • Conduct periodic reassessment of critical suppliers.
  • Establish appropriate security clauses, audit rights and breach-notification requirements in collaboration with Legal.

11. Security Awareness & Culture

  • Establish an organisation-wide security awareness programme.
  • Conduct phishing simulations, secure-development training and role-specific security raining.
  • Build a culture where security is considered a shared responsibility across Engineering,
  • Product, IT and business teams.
  • Establish security champions within engineering/product teams.

12. Emerging Technology & AI Security

  • Establish security governance for the company's adoption of Generative AI, AI agents, LLMs and other emerging technologies.
  • Assess risks associated with AI-enabled product features and internal AI usage.
  • Define controls for data leakage, model access, prompt injection, supply-chain risks and inappropriate use of sensitive information.
  • Partner with Product, Engineering, Legal and Privacy teams on responsible and secure AI adoption.

Candidate Profile

Essential

  • 10–18+ years of experience in Information Security / Cybersecurity.
  • Significant experience in a SaaS, cloud, technology product or enterprise software environment.
  • Demonstrated ownership of an enterprise-wide security programme.
  • Strong understanding of both Product Security and Enterprise Information Security.
  • Experience with ISO 27001, SOC 2 and GDPR.
  • Strong understanding of cloud security, preferably across AWS and/or Azure.
  • Strong application-security and DevSecOps understanding.
  • Experience managing security incidents and cyber-risk programmes.
  • Experience interacting with enterprise customers on security assessments.
  • Strong understanding of security governance, risk and compliance.
  • Demonstrated ability to influence senior Engineering, Product and Business leaders.
  • Exposure to AI security / AI governance.

Preferred

  • CISSP / CISM / CCSP / CRISC or equivalent.
  • Experience taking a SaaS company through SOC 2 / ISO 27001 certification and subsequent maturation.
  • Experience with GDPR / DPDP and international privacy requirements.
  • Experience with enterprise customer security audits.
  • Experience with security architecture and threat modelling.
  • Experience with SBOM / software supply-chain security.
  • Prior experience as CISO, Deputy CISO, Head of Information Security, Director – Information
  • Security or Associate Director – Information Security.
From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against Disprz's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on Disprz's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    Disprz's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.