Chief Information Security Officer

TAC Security is a global cybersecurity company helping enterprises understand and reduce cyber risk through risk-based vulnerability management, attack surface management, security assessments, managed security services and cybersecurity consulting.

About the Role

We are looking for a Chief Information Security Officer to lead TAC Security's information security strategy and strengthen security across our business, products and operations.

The CISO will work closely with executive leadership, Engineering, Product, IT and business teams to identify and manage cyber risks, protect company and customer information, and build security practices that support global growth.

This is a hands-on leadership role requiring strategic judgment, technical depth and the ability to build practical security programs in a growing cybersecurity company. The CISO will also represent TAC Security in strategic customer conversations and provide executive guidance on cybersecurity matters.

Key Responsibilities

Security Strategy & Executive Leadership

• Define and execute TAC Security's information security strategy, roadmap and priorities.
• Establish a security governance model with clear ownership, policies and accountability across functions.
• Advise the CEO and executive leadership on cyber risks, security investments and business implications.
• Present security posture, material risks and progress to executive leadership and the Board, as required.
• Own security budget planning and prioritise investments based on risk and business needs.

Enterprise Security & Cyber Risk Management

• Lead the protection of company systems, infrastructure, applications and sensitive information.
• Establish and maintain an enterprise cyber risk register, with mitigation plans and accountable business owners.
• Oversee identity and access management, endpoint security, cloud security, data protection and vulnerability management.
• Establish third-party security assessments and manage risks associated with vendors and partners.
• Define a documented process for risk escalation, exceptions and acceptance by authorised business leaders.

Product & Application Security

• Partner with Product and Engineering to embed security into product design and the software development lifecycle.
• Establish secure development practices, application security testing and remediation expectations.
• Oversee product security reviews, penetration testing and vulnerability disclosure processes.
• Strengthen security across cloud environments, APIs and software dependencies.
• Ensure customer data protection and security commitments are reflected in product and operational practices.

Security Operations & Incident Management

• Establish effective security monitoring, threat detection and incident response capabilities.
• Define incident response plans, escalation procedures and executive communication protocols.
• Lead the company's response to significant cybersecurity incidents.
• Conduct incident simulations and ensure lessons learned translate into corrective actions.
• Partner with IT and business leaders on business continuity, disaster recovery and recovery testing.

Governance, Compliance & Customer Assurance

• Own the company's information security policies, standards and control framework.
• Lead security readiness for relevant certifications, customer assessments and audits.
• Align the security program with appropriate frameworks such as ISO 27001, NIST CSF and CIS Controls.
• Partner with Legal and relevant business teams on applicable privacy, regulatory and contractual obligations.
• Support customer due diligence, security questionnaires and assurance discussions with accurate, evidence-based responses.

Customer & Industry Engagement

• Act as an executive security advisor in strategic customer and partner discussions.
• Support Sales and Pre-Sales on complex security requirements and customer assurance.
• Partner with Delivery leadership to define security standards and advise on significant technical risks or incidents.
• Represent TAC Security at relevant industry forums and executive discussions.
• Bring customer and market insights into the company's security and product priorities.

Team Leadership & Security Culture

• Build and lead the information security function, using internal capabilities and external partners as appropriate.
• Define team structure, hiring priorities and capability development plans.
• Develop a company-wide security awareness program tailored to different roles.
• Coach security professionals and build clear performance expectations.
• Make security a shared responsibility across the organisation.

Required Qualifications

• Bachelor's degree in Computer Science, Information Security, Engineering or a related field, or equivalent relevant experience.
• 15+ years of relevant cybersecurity experience, including significant experience leading security teams or programs.
• Experience as a CISO, Deputy CISO, Head of Information Security or equivalent senior security leader.
• Demonstrated ownership of an organisation's internal information security strategy and cyber risk program.
• Strong understanding of cloud security, application security, enterprise security architecture and incident response.
• Experience establishing security governance, managing audits and supporting customer security assurance.
• Ability to communicate technical risks clearly to executive leadership and translate them into business decisions.
• Experience building practical security programs in a technology company or a growing business.
• Willingness to work on-site in Chandigarh.

Preferred Qualifications

• Experience in cybersecurity products, SaaS or other enterprise technology businesses.
• Experience supporting a global business and enterprise customers.
• Experience building or scaling a security function with limited resources.
• CISSP, CISM, CCISO or CRISC certification.
• Relevant cloud security or ISO 27001 qualifications.

Key Competencies

• Strategic judgment and business acumen
• Cyber risk management
• Technical depth and practical execution
• Executive communication
• Incident and crisis leadership
• Cross-functional influence
• Team building and development

Success Measures

• Progress against the agreed security roadmap
• Timely remediation of critical security risks and vulnerabilities
• Effectiveness of incident detection, response and recovery
• Closure of audit findings and control gaps
• Product security improvements and adoption of secure development practices
• Customer assurance quality and responsiveness
• Security awareness and adherence across the organisation