Chief Information Security Officer

This role is for one of Weekday’s clients

Min Experience: 3+ years

Location: Bengaluru, Karnataka

JobType: full-time

We are seeking a strategic and hands-on Chief Information Security Officer (CISO) to lead the organization’s information security, cybersecurity, and risk management initiatives. The CISO will be responsible for establishing and strengthening security frameworks, protecting critical business information and technology assets, managing security risks, and ensuring compliance with applicable security standards and regulatory requirements.

The ideal candidate should have strong expertise in Information Security, Cloud Security, and SOC 2 and be capable of working across technology, engineering, operations, legal, compliance, and leadership teams. This role requires a combination of strategic thinking, technical understanding, risk management, and the ability to build a strong security culture across the organization.

Requirements

Key Responsibilities

• Develop, implement, and continuously improve the organization’s overall information security strategy, policies, standards, and procedures.
• Establish a comprehensive cybersecurity and risk management program aligned with business objectives and industry best practices.
• Lead the identification, assessment, prioritization, and mitigation of information security risks across applications, infrastructure, networks, endpoints, and business processes.
• Design and implement effective cloud security practices across cloud infrastructure, applications, identities, data, and workloads.
• Establish security controls for cloud environments, including identity and access management, encryption, logging, monitoring, vulnerability management, and configuration management.
• Own and manage the organization’s SOC 2 readiness and compliance initiatives, including control design, evidence collection, risk assessments, and coordination with auditors.
• Develop and maintain security policies covering access control, data protection, incident response, business continuity, vulnerability management, and third-party risk.
• Lead security incident response activities, including preparation, detection, investigation, containment, remediation, and post-incident reviews.
• Establish security monitoring and threat detection capabilities in collaboration with engineering and IT teams.
• Conduct periodic security assessments, vulnerability reviews, penetration testing, and risk evaluations.
• Manage third-party and vendor security assessments to identify potential risks associated with external service providers.
• Partner with engineering and product teams to integrate security into the software development lifecycle and technology architecture.
• Develop and maintain disaster recovery, business continuity, and cybersecurity incident response plans.
• Monitor emerging cybersecurity threats, vulnerabilities, technologies, and regulatory requirements and translate them into actionable security initiatives.
• Provide regular security and risk reporting to senior leadership, highlighting key risks, compliance status, incidents, and remediation plans.
• Promote security awareness and best practices through employee training, communication, and organization-wide security initiatives.

Required Qualifications

• 3-10 years of experience in information security, cybersecurity, security engineering, risk management, or a related field.
• Strong understanding of enterprise Information Security principles, frameworks, controls, and risk management practices.
• Hands-on knowledge of Cloud Security across platforms such as AWS, Azure, or Google Cloud.
• Practical understanding of SOC 2 compliance, security controls, audit processes, and evidence management.
• Experience developing and implementing information security policies, standards, and procedures.
• Strong understanding of identity and access management, encryption, network security, vulnerability management, and security monitoring.
• Experience handling cybersecurity incidents and coordinating remediation activities.
• Strong analytical, communication, stakeholder-management, and leadership skills.

Good-to-Have Skills

• Experience with security frameworks such as ISO 27001, NIST CSF, CIS Controls, or PCI DSS.
• Relevant certifications such as CISSP, CISM, CCSP, or CISA.
• Exposure to SIEM, EDR, vulnerability-management, and security-monitoring platforms.
• Experience with security automation, DevSecOps, and secure software development practices.
• Knowledge of privacy and data-protection requirements.
• Experience working with external auditors, customers, and enterprise security teams.