{"id":4223750,"url":"https://alion.io/job/shopse-infosec-lead","title":"InfoSec Lead","company":{"id":3784028,"name":"ShopSe","domain":"getshopse.com","url":"https://alion.io/company/getshopse","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Keka","truth_index":{"grade":"B","score":75,"open_postings":6,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":null,"computed_at":"2026-11-12T10:38:37Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Mumbai, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":2000000,"max":3000000,"currency":"INR","period":"year","gross":null,"usd_annual":32031},"salary_estimate":null,"experience_years_min":7,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"GCP","optional":false},{"name":"ISO 27001","optional":false},{"name":"NIST CSF","optional":false},{"name":"PCI DSS","optional":false},{"name":"SOC 2","optional":false}],"status":"live","first_seen_at":"2026-11-13T06:39:23Z","employer_posted_date":"2026-11-13","last_verified_at":"2026-11-13T06:48:58Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"1. Compliance & Certification Management\nOwn end-to-end lifecycle management of PCI DSS certification - scoping, gap assessments, remediation tracking, QSA engagement, and annual renewals.\nMaintain and renew ISO 27001 certification including surveillance audits, internal audits, ISMS documentation, and continual improvement.\nProactively identify and drive adoption of any new certifications required by regulators, customers, or business partners (e.g. SOC 2, DPDP alignment, RBI guidelines).\nMaintain a compliance calendar and ensure zero lapses in certification validity. 2. DPDP (Digital Personal Data Protection) Act Compliance\nLead ShopSe's compliance programme under India's DPDP Act, 2023.\nConduct data mapping and classification exercises; maintain an updated data inventory.\nDraft, implement, and operationalise privacy notices, consent mechanisms, and data principal rights workflows. Coordinate with product, engineering, and legal teams to embed privacy-by-design principles.\nManage Data Fiduciary obligations and liaise with the Data Protection Board when required.\nExternal & Regulatory Audit Management\nServe as the primary point of contact for all external audits conducted by regulated entities on ShopSe in its capacity as a TSP (Technology Service Provider) or LSP (Lending Service Provider).\nCoordinate bank and NBFC partner audits, including audit scheduling, evidence collection, and response management.\nEnsure audit readiness at all times; maintain an evergreen evidence repository.\nTrack and close all audit observations and non-conformities within agreed timelines.\nBuild and maintain strong relationships with auditors, regulators, and partner compliance teams.\nInformation Security Management\nDefine, implement, and maintain the Information Security Management System (ISMS) and security policies.\nConduct periodic risk assessments, vulnerability assessments, and threat modelling.\nOversee VAPT (Vulnerability Assessment & Penetration Testing) - vendor management, scoping, and remediation tracking.\nManage security incident response - detection, containment, RCA, and reporting.\nDrive security awareness and training programmes across the organisation.\nVendor & Third-Party Risk Management\nAssess security posture of third-party vendors and technology partners.\nMaintain a vendor risk register and conduct periodic reviews.\nEnsure contractual security obligations (MSA/DPA clauses) are in place with all critical vendors.\nRequirements Essential Qualifications & Experience\n7-8 years of hands-on experience in information security, compliance, or GRC roles - ideally as a #2 or #3 in an infosec team where you were doing the execution, not just overseeing it.\nProven track record of managing PCI DSS and ISO 27001 certifications end-to-end.\nPrior experience in a fintech, payments, or BFSI environment as a TSP or LSP is strongly preferred.\nDeep understanding of RBI guidelines for technology and outsourcing (e.g. Master Directions on IT, Outsourcing Guidelines).\nWorking knowledge of DPDP Act, 2023 and its operational implications.\nExperience handling regulatory/partner audits independently.\nTechnical Skills\nStrong knowledge of ISO 27001, PCI DSS (v4.0), NIST CSF, and related frameworks.\nProficiency in risk assessment methodologies and security control frameworks.\nFamiliarity with cloud security (AWS/Azure/GCP) and SaaS security considerations.\nHands-on experience with GRC tools Certifications (Required / Preferred)\nCISM, CISSP, or CISA - at least one is required.\nISO 27001 Lead Implementer or Lead Auditor - highly preferred.\nPCI DSS Internal Security Assessor (ISA) - preferred\nAny DPDP/privacy certification (e.g. CIPP, OneTrust Certified) is a plus.\nSoft Skills\nExcellent stakeholder management - comfortable engaging with C-suite, regulators, auditors, and bank partners.\nStrong written and verbal communication; ability to translate technical risk into business language.\nSelf-starter with the ability to build and run a function independently.\nDetail-oriented, methodical, and deadline-driven.","description_format":"text","description_chars":4042,"description_truncated":false,"requirements":{"experience_years_min":7,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Information Security","Payment Processing & Gateways","Buy Now, Pay Later"],"lifecycle":[{"event":"open","at":"2026-11-13T06:48:58Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":29,"reasons":["conf:2","win:early"],"computed_at":"2026-11-13T09:40:13Z"},"pay":{"stated_usd_annual":32031,"is_top_pay":false},"html_url":"https://alion.io/job/shopse-infosec-lead","json_url":"https://alion.io/job/shopse-infosec-lead.json","meta":{"generated_at":"2026-11-13T09:40:13Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":19895,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-14T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":3784028},"rest":"https://alion.io/mcp/rest/get_company?id=3784028"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fshopse-infosec-lead"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"free","price":{"credits":0,"usd":0},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fshopse-infosec-lead"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fshopse-infosec-lead"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/shopse-infosec-lead\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fshopse-infosec-lead"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4223750}},{"tool":"search_jobs","arguments":{"company":"getshopse.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4223750},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}