Director - Information Security

The Director - Security will lead Tata Digital's cyber defence capabilities and help protect customer, business, technology, and enterprise assets across the organisation and associated entities. The role owns the strategy, governance, and operational effectiveness of the Security Operations Centre (SOC), incident response, threat detection and hunting, vulnerability and exposure management, cloud security operations, security engineering, and cyber resilience. The incumbent will partner with Product Engineering, Cloud Operations, Infrastructure, DevSecOps, Privacy, Risk, Compliance, Legal, Communications, and Tata Group security stakeholders.

The candidate will have responsibilities across the following functions:

Strategy, Governance and Leadership:

• Define and execute the Security Operations strategy, operating model, capability roadmap, and annual priorities aligned with Tata Digital's business and cybersecurity objectives.
• Establish governance mechanisms, policies, standards, procedures, service-level objectives, and management reporting for cyber defence operations.
• Provide clear security posture, incident, vulnerability, control-effectiveness, and operational-risk updates to the CISO, executive leadership, and relevant governance forums.
• Lead financial planning, technology investments, vendor governance, and capacity planning for Security Operations.

24x7 Security Operations:

• Lead Tata Digital's 24x7 in-house SOC and ensure continuous monitoring of cloud services, endpoints, servers, identities, networks, business applications, and customer-facing digital platforms.
• Drive effective triage, investigation, escalation, containment, and reporting through standardised playbooks and well-defined accountability.
• Continuously improve SIEM, EDR/XDR, SOAR, email security, network security, and other monitoring technologies.
• Mature detection coverage using threat-informed methodologies, including MITRE ATT& CK mapping, measurable use-case coverage, and regular control validation.

Incident Response and Cyber Crisis Management:

• Act as the senior operational leader for major cyber incidents, coordinating triage, containment, eradication, recovery, and executive communication.
• Maintain enterprise incident response plans, technical playbooks, crisis-management procedures, breach-response workflows, and escalation matrices.
• Coordinate incident response across Technology, Product, Privacy, Legal, Risk, Communications, Human Resources, business teams, and external partners.
• Lead post-incident reviews, root-cause analysis, lessons learned, and closure of identified control gaps.
• Plan and conduct cyber crisis simulations, tabletop exercises, red-team scenarios, and readiness assessments.

Threat Detection, Intelligence and Hunting:

• Build intelligence-led threat detection and proactive threat-hunting capabilities tailored to Tata Digital's digital ecosystem.
• Use internal telemetry and external threat intelligence to identify adversary behaviour, emerging attack patterns, and sector-relevant threats.
• Prioritise threats to digital commerce, financial services, loyalty platforms, APIs, customer journeys, cloud environments, and critical third parties.
• Convert threat intelligence and incident learnings into new detection rules, hunting hypotheses, and preventive controls.

Vulnerability and Exposure Management:

• Own the enterprise vulnerability and exposure management lifecycle, including discovery, assessment, prioritisation, remediation governance, exception handling, and reporting.
• Govern vulnerability assessments, penetration testing, configuration reviews, red-team exercises, and validation of remediation outcomes.
• Define risk-based remediation SLAs and drive accountability for timely closure of critical and high-risk exposures.
• Provide executive dashboards showing exposure trends, ageing, business ownership, SLA adherence, and measurable risk reduction.

Cloud, Container and Infrastructure Security Operations:

• Lead operational security across Azure, AWS, Kubernetes, containers, endpoints, servers, networks, and hybrid technology environments.
• Drive operationalisation of cloud-native security capabilities such as CNAPP, CSPM, CWPP, container security, and cloud detection and response.
• Ensure adequate telemetry, monitoring, alerting, response playbooks, and technical ownership across cloud and infrastructure environments.
• Partner with Cloud, Platform Engineering, SRE, and Infrastructure teams to reduce attack surface and improve secure configuration and resilience.

Identity and Access Security Operations:

• Govern operational security controls for Microsoft Entra ID, Active Directory, Microsoft 365, privileged access, and access governance.
• Drive least privilege, role-based access control, privileged identity monitoring, joiner-mover-leaver controls, and periodic access reviews.
• Partner with IAM and technology teams to strengthen identity threat detection and improve response to identity-based attacks.

Security Engineering, Automation and AI:

• Drive SOC modernisation through detection engineering, security automation, orchestration, and AI-assisted investigation and response.
• Expand SOAR-driven workflows and automate repetitive controls while retaining appropriate human oversight for high-impact decisions.
• Improve Mean Time to Detect, Mean Time to Respond, analyst productivity, investigation quality, and incident-handling consistency.
• Ensure that automation and AI capabilities are implemented with security, privacy, transparency, and accountability safeguards.

Digital Product and DevSecOps Partnership:

• Partner with Product Engineering and DevSecOps teams to embed actionable operational security requirements into the development and release lifecycle.
• Improve monitoring and rapid-response readiness for APIs, web and mobile applications, customer journeys, and digital commerce platforms.
• Feed vulnerabilities, incidents, threat intelligence, and attack trends back into secure design, engineering standards, and backlog priorities.

Regulatory, Audit and Group Alignment:

• Support compliance with applicable legal, regulatory, contractual, and internal requirements, including CERT-In Directions, the Digital Personal Data Protection framework, PCI DSS, ISO/IEC 27001, and Tata Group cybersecurity requirements.
• Provide timely, accurate operational evidence for internal audits, external assessments, regulatory reviews, and management assurance.
• Coordinate with Tata Group security stakeholders and relevant ecosystem partners on cyber defence priorities, incidents, and shared risk themes.

Vendor and Third-Party Security Operations:

• Oversee security operations delivered by technology vendors, service providers, and specialist partners.
• Ensure appropriate monitoring, incident notification, escalation, evidence retention, performance measurement, and service continuity obligations.
• Support ongoing cyber-risk monitoring for critical suppliers and services within Tata Digital's ecosystem.

People and Capability Leadership:

• Lead and develop a multidisciplinary team comprising SOC analysts, incident responders, threat hunters, security engineers, and vulnerability management specialists.
• Build role clarity, competency frameworks, shift effectiveness, succession plans, and a sustainable leadership pipeline.
• Create a culture of accountability, learning, collaboration, operational discipline, and continuous improvement.

Success Measures:

• Improvement in Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), and time to contain high-impact incidents.
• Reduction in recurring incidents and material exposure across critical assets and customer-facing platforms.
• Compliance with risk-based vulnerability remediation SLAs and reduction in ageing critical and high-risk items.
• Increase in detection coverage, use-case effectiveness, threat-hunting outcomes, and security automation adoption.
• Improvement in cloud and container security posture, asset visibility, and monitoring coverage.
• Timely closure of audit, regulatory, and post-incident actions.
• Demonstrable improvement in cyber resilience, crisis readiness, and recovery effectiveness.
• Retention, capability growth, and succession readiness across the Security Operations team.

Requirements:

• Bachelor's degree in Computer Science/ Engineering, or a related discipline.
• A master's degree in cybersecurity, technology, or business administration is preferred.
• 15+ years of cybersecurity experience, including significant leadership responsibility in Security Operations and Incident Response.
• 8+ years leading enterprise cyber defence, SOC, incident response, threat detection, or related operational security functions.
• Proven experience leading a large-scale, always-on SOC in a cloud-first or digital business environment.
• Experience in digital platforms, eCommerce, fintech, payments, financial services, telecommunications, or another regulated technology-led environment.
• Demonstrated ability to manage significant cyber incidents and communicate effectively with executive leadership and governance forums.

Technical Expertise:

• Microsoft Sentinel and comparable SIEM/SOAR platforms.
• CrowdStrike, Microsoft Defender, or comparable EDR/XDR technologies.
• Azure and AWS security operations.
• CNAPP, CSPM, CWPP, Kubernetes, and container security.
• Vulnerability management and exposure management platforms.
• Threat intelligence, threat hunting, incident response, and digital forensics.
• Identity security, IAM, PAM, Microsoft Entra ID, and Active Directory.
• AI, API, web, mobile, email, endpoint, network, and cloud detection controls.
• Security engineering, automation, analytics, and AI-assisted operations.

Preferred Certifications:

• CISSP, CISM, or equivalent senior cybersecurity certification.
• CCSP or relevant cloud security certification.

Leadership Competencies:

• Strategic leadership and enterprise thinking.
• Executive presence and concise risk communication.
• Crisis leadership and decision-making under pressure.
• Operational excellence and data-driven management.
• Business acumen and customer-centric risk judgment.
• Stakeholder influence across product, engineering, technology, and corporate functions.
• Talent development, coaching, and succession planning.
• Innovation, automation, and a continuous-improvement mindset.

Skills

director, incident response, Information Security, security architecture, security operations, SOC, cybersecurity, IR, security