Vice President - IT

The core responsibilities for the job include the following:

SOC 2 and Compliance (SaaS Security Governance):

• SOC 2 Type 2 ownership: Drive the end-to-end certification process via Scrut.io policy authoring, evidence collection, control implementation, and audit readiness.
• ISO 27001 and DPR/DPDP: Establish and maintain compliance with ISO 27001 GDPR, and India's DPDP Act. Conduct periodic risk assessments and gap analyses.
• Define and enforce information security policies, access control frameworks, incident response plans, and data classification standards.
• Serve as the primary point of contact for external auditors, client security questionnaires,
• and due diligence requests.

DevSecOps and Application Security:

• SAST/DAST integration: Implement and manage static and dynamic application security testing tools (e. g., SonarQube, Snyk, OWASP ZAP, and Burp Suite) within the CI/CD pipeline.
• Embed security gates into GitHub-based workflows: pre-commit hooks, dependency scanning, container image scanning, and secrets detection.
• Own vulnerability management: triage findings, coordinate remediation with engineering, and track SLA compliance.
• Conduct periodic penetration testing (internal or coordinated third-party) and code review for security-critical modules.

AWS Administration and Cloud Security:

• AWS estate ownership: Manage IAM policies, VPCs, security groups, S3 bucket policies, KMS, CloudTrail, GuardDuty, and AWS Config.
• Architect and enforce least-privilege access models, network segmentation, and encryption-at-rest/in-transit across all AWS services.
• Implement infrastructure-as-code security (Terraform/CloudFormation guardrails) and drift detection.
• Cost and ops hygiene: Monitor AWS spend, right-size resources, manage Reserved Instances/Savings Plans, and maintain tagging standards.
• Design and maintain disaster recovery and business continuity procedures for cloud-hosted services.

Network Security:

• Design and manage network security architecture, firewalls, VPNs, WAFs, DDoS mitigation, and DNS security.
• Implement zero-trust principles for remote-first and hybrid team access.
• Monitor network traffic and configure alerting for anomalous activity using cloud-native and third-party tools.
• Manage endpoint security (MDM, EDR) for company-issued and BYOD devices.

Internal Tools and Vendor Management:

• Google Workspace (Business Standard): Administer Google Workspace user provisioning/deprovisioning, security policies, DLP rules, OAuth app whitelisting, and drive sharing controls.
• Splunk AI / SIEM: Set up and manage Splunk AI (or equivalent) for centralised log management, security event correlation, and alerting.
• Vendor management: Own the security and compliance evaluation of third-party SaaS tools. Maintain a vendor risk register, conduct periodic reviews, and negotiate security terms in vendor contracts.
• Manage internal helpdesk and IT support operations, including onboarding/offboarding, access provisioning, hardware procurement, and license management.
• Evaluate, procure, and sunset internal tools based on cost, security posture, and team needs.

Requirements:

• 6-12 years of progressive experience in information security, IT operations, or DevSecOps with at least 2 years in a leadership or sole-owner capacity.
• Hands-on experience driving SOC 2 Type 2 or ISO 27001 certification in a SaaS or cloud-native environment.
• Strong working knowledge of AWS services (IAM, VPC, GuardDuty, CloudTrail, KMS, S3 EC2 ECS/EKS) and infrastructure-as-code tools.
• Proven experience implementing SAST/DAST tools and integrating security into CI/CD pipelines (GitHub Actions, Jenkins, or similar).
• Experience administering Google Workspace and managing SaaS vendor security.
• Solid understanding of network security principles, firewalls, VPNs, WAFs, DNS, and zero-trust architecture.

Good-to-Have:

• Experience with Scrut.io, Vanta, Drata, or similar compliance automation platforms.
• Familiarity with Splunk, Datadog Security, or equivalent SIEM/observability tools.
• Relevant certifications: CISSP, CISM, CCSP, AWS Security Speciality, or CompTIA Security+.
• Experience in a startup or early-stage environment where you built security/IT programs from scratch.
• Exposure to procurement technology, electronics supply chains, or B2B SaaS platforms.
• Certifications (Preferred / Required): CISM, CISA, or CISSP certification preferred.