{"id":2923100,"url":"https://alion.io/job/tata-group-director-information-security","title":"Director - Information Security","company":{"id":3198,"name":"Tata Group","domain":"tata.com","url":"https://alion.io/company/tata","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":null,"truth_index":null},"role":"Leadership","role_family":"Leadership","seniority":"head","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Gurgaon, India","Mumbai, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":53000,"max_usd":129000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":49},"experience_years_min":16,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Crowdstrike","optional":false},{"name":"IAM","optional":false},{"name":"Kubernetes","optional":false},{"name":"Least Privilege","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"PCI DSS","optional":false},{"name":"SIEM","optional":false}],"status":"live","first_seen_at":"2026-10-20T12:37:00Z","employer_posted_date":null,"last_verified_at":"2026-10-20T12:37:00Z","board_verified":false,"closed_at":null,"days_open":1,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":1},"description":"The Director - Security will lead Tata Digital's cyber defence capabilities and help protect customer, business, technology, and enterprise assets across the organisation and associated entities. The role owns the strategy, governance, and operational effectiveness of the Security Operations Centre (SOC), incident response, threat detection and hunting, vulnerability and exposure management, cloud security operations, security engineering, and cyber resilience. The incumbent will partner with Product Engineering, Cloud Operations, Infrastructure, DevSecOps, Privacy, Risk, Compliance, Legal, Communications, and Tata Group security stakeholders.\n\nThe candidate will have responsibilities across the following functions: \n\nStrategy, Governance and Leadership: \nDefine and execute the Security Operations strategy, operating model, capability roadmap, and annual priorities aligned with Tata Digital's business and cybersecurity objectives.\nEstablish governance mechanisms, policies, standards, procedures, service-level objectives, and management reporting for cyber defence operations.\nProvide clear security posture, incident, vulnerability, control-effectiveness, and operational-risk updates to the CISO, executive leadership, and relevant governance forums.\nLead financial planning, technology investments, vendor governance, and capacity planning for Security Operations.\n\n24x7 Security Operations: \nLead Tata Digital's 24x7 in-house SOC and ensure continuous monitoring of cloud services, endpoints, servers, identities, networks, business applications, and customer-facing digital platforms.\nDrive effective triage, investigation, escalation, containment, and reporting through standardised playbooks and well-defined accountability.\nContinuously improve SIEM, EDR/XDR, SOAR, email security, network security, and other monitoring technologies.\nMature detection coverage using threat-informed methodologies, including MITRE ATT& CK mapping, measurable use-case coverage, and regular control validation.\n\nIncident Response and Cyber Crisis Management: \nAct as the senior operational leader for major cyber incidents, coordinating triage, containment, eradication, recovery, and executive communication.\nMaintain enterprise incident response plans, technical playbooks, crisis-management procedures, breach-response workflows, and escalation matrices.\nCoordinate incident response across Technology, Product, Privacy, Legal, Risk, Communications, Human Resources, business teams, and external partners.\nLead post-incident reviews, root-cause analysis, lessons learned, and closure of identified control gaps.\nPlan and conduct cyber crisis simulations, tabletop exercises, red-team scenarios, and readiness assessments.\n\nThreat Detection, Intelligence and Hunting: \nBuild intelligence-led threat detection and proactive threat-hunting capabilities tailored to Tata Digital's digital ecosystem.\nUse internal telemetry and external threat intelligence to identify adversary behaviour, emerging attack patterns, and sector-relevant threats.\nPrioritise threats to digital commerce, financial services, loyalty platforms, APIs, customer journeys, cloud environments, and critical third parties.\nConvert threat intelligence and incident learnings into new detection rules, hunting hypotheses, and preventive controls.\n\nVulnerability and Exposure Management: \nOwn the enterprise vulnerability and exposure management lifecycle, including discovery, assessment, prioritisation, remediation governance, exception handling, and reporting.\nGovern vulnerability assessments, penetration testing, configuration reviews, red-team exercises, and validation of remediation outcomes.\nDefine risk-based remediation SLAs and drive accountability for timely closure of critical and high-risk exposures.\nProvide executive dashboards showing exposure trends, ageing, business ownership, SLA adherence, and measurable risk reduction.\n\nCloud, Container and Infrastructure Security Operations: \nLead operational security across Azure, AWS, Kubernetes, containers, endpoints, servers, networks, and hybrid technology environments.\nDrive operationalisation of cloud-native security capabilities such as CNAPP, CSPM, CWPP, container security, and cloud detection and response.\nEnsure adequate telemetry, monitoring, alerting, response playbooks, and technical ownership across cloud and infrastructure environments.\nPartner with Cloud, Platform Engineering, SRE, and Infrastructure teams to reduce attack surface and improve secure configuration and resilience.\n\nIdentity and Access Security Operations: \nGovern operational security controls for Microsoft Entra ID, Active Directory, Microsoft 365, privileged access, and access governance.\nDrive least privilege, role-based access control, privileged identity monitoring, joiner-mover-leaver controls, and periodic access reviews.\nPartner with IAM and technology teams to strengthen identity threat detection and improve response to identity-based attacks.\n\nSecurity Engineering, Automation and AI: \nDrive SOC modernisation through detection engineering, security automation, orchestration, and AI-assisted investigation and response.\nExpand SOAR-driven workflows and automate repetitive controls while retaining appropriate human oversight for high-impact decisions.\nImprove Mean Time to Detect, Mean Time to Respond, analyst productivity, investigation quality, and incident-handling consistency.\nEnsure that automation and AI capabilities are implemented with security, privacy, transparency, and accountability safeguards.\n\nDigital Product and DevSecOps Partnership: \nPartner with Product Engineering and DevSecOps teams to embed actionable operational security requirements into the development and release lifecycle.\nImprove monitoring and rapid-response readiness for APIs, web and mobile applications, customer journeys, and digital commerce platforms.\nFeed vulnerabilities, incidents, threat intelligence, and attack trends back into secure design, engineering standards, and backlog priorities.\n\nRegulatory, Audit and Group Alignment: \nSupport compliance with applicable legal, regulatory, contractual, and internal requirements, including CERT-In Directions, the Digital Personal Data Protection framework, PCI DSS, ISO/IEC 27001, and Tata Group cybersecurity requirements.\nProvide timely, accurate operational evidence for internal audits, external assessments, regulatory reviews, and management assurance.\nCoordinate with Tata Group security stakeholders and relevant ecosystem partners on cyber defence priorities, incidents, and shared risk themes.\n\nVendor and Third-Party Security Operations: \nOversee security operations delivered by technology vendors, service providers, and specialist partners.\nEnsure appropriate monitoring, incident notification, escalation, evidence retention, performance measurement, and service continuity obligations.\nSupport ongoing cyber-risk monitoring for critical suppliers and services within Tata Digital's ecosystem.\n\nPeople and Capability Leadership: \nLead and develop a multidisciplinary team comprising SOC analysts, incident responders, threat hunters, security engineers, and vulnerability management specialists.\nBuild role clarity, competency frameworks, shift effectiveness, succession plans, and a sustainable leadership pipeline.\nCreate a culture of accountability, learning, collaboration, operational discipline, and continuous improvement.\n\nSuccess Measures: \nImprovement in Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), and time to contain high-impact incidents.\nReduction in recurring incidents and material exposure across critical assets and customer-facing platforms.\nCompliance with risk-based vulnerability remediation SLAs and reduction in ageing critical and high-risk items.\nIncrease in detection coverage, use-case effectiveness, threat-hunting outcomes, and security automation adoption.\nImprovement in cloud and container security posture, asset visibility, and monitoring coverage.\nTimely closure of audit, regulatory, and post-incident actions.\nDemonstrable improvement in cyber resilience, crisis readiness, and recovery effectiveness.\nRetention, capability growth, and succession readiness across the Security Operations team.\n\nRequirements: \nBachelor's degree in Computer Science/ Engineering, or a related discipline.\nA master's degree in cybersecurity, technology, or business administration is preferred.\n15+ years of cybersecurity experience, including significant leadership responsibility in Security Operations and Incident Response.\n8+ years leading enterprise cyber defence, SOC, incident response, threat detection, or related operational security functions.\nProven experience leading a large-scale, always-on SOC in a cloud-first or digital business environment.\nExperience in digital platforms, eCommerce, fintech, payments, financial services, telecommunications, or another regulated technology-led environment.\nDemonstrated ability to manage significant cyber incidents and communicate effectively with executive leadership and governance forums.\n\nTechnical Expertise: \nMicrosoft Sentinel and comparable SIEM/SOAR platforms.\nCrowdStrike, Microsoft Defender, or comparable EDR/XDR technologies.\nAzure and AWS security operations.\nCNAPP, CSPM, CWPP, Kubernetes, and container security.\nVulnerability management and exposure management platforms.\nThreat intelligence, threat hunting, incident response, and digital forensics.\nIdentity security, IAM, PAM, Microsoft Entra ID, and Active Directory.\nAI, API, web, mobile, email, endpoint, network, and cloud detection controls.\nSecurity engineering, automation, analytics, and AI-assisted operations.\n\nPreferred Certifications: \nCISSP, CISM, or equivalent senior cybersecurity certification.\nCCSP or relevant cloud security certification.\n\nLeadership Competencies: \nStrategic leadership and enterprise thinking.\nExecutive presence and concise risk communication.\nCrisis leadership and decision-making under pressure.\nOperational excellence and data-driven management.\nBusiness acumen and customer-centric risk judgment.\nStakeholder influence across product, engineering, technology, and corporate functions.\nTalent development, coaching, and succession planning.\nInnovation, automation, and a continuous-improvement mindset.\nSkills\ndirector, incident response, Information Security, security architecture, security operations, SOC, cybersecurity, IR, security","description_format":"text","description_chars":10446,"description_truncated":false,"requirements":{"experience_years_min":16,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Hotels & Resorts","Air Transport","Incident Response","Commercial Aviation"],"lifecycle":[{"event":"open","at":"2026-10-20T12:37:00Z"}],"visa":[{"country":"GB","licensed_sponsor":true,"evidence":"Licensed UK visa sponsor (Skilled Worker, Senior or Specialist Worker)","filings_12m":null,"filings_prev_12m":null,"green_card_filings_12m":null,"median_offered_wage_usd":null,"route":"Skilled Worker; Global Business Mobility: Senior or Specialist Worker","cap_exempt":false,"checked_at":"2026-10-22T06:27:10+00:00","sources":["UK Home Office: register of licensed sponsors (workers)"],"filings_for_role_12m":0}],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":1,"expected_fill_days":22,"reasons":["seen:1","win:early"],"computed_at":"2026-10-22T06:10:10Z"},"pay":null,"html_url":"https://alion.io/job/tata-group-director-information-security","json_url":"https://alion.io/job/tata-group-director-information-security.json","meta":{"generated_at":"2026-10-22T11:01:50Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":8651,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-23T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":3198},"rest":"https://alion.io/mcp/rest/get_company?id=3198"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ftata-group-director-information-security"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ftata-group-director-information-security"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ftata-group-director-information-security"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/tata-group-director-information-security\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ftata-group-director-information-security"}]}