{"id":2795789,"url":"https://alion.io/job/yanoljacloudsolution-head-of-information-security","title":"Head of Information Security","company":{"id":2894890,"name":"Yanolja Cloud Solution","domain":"yanoljacloudsolution.com","url":"https://alion.io/company/yanoljacloudsolution","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Keka","truth_index":null},"role":"Leadership","role_family":"Leadership","seniority":"head","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Surat, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":2000000,"max":2400000,"currency":"INR","period":"year","gross":null,"usd_annual":25358},"salary_estimate":null,"experience_years_min":10,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Amazon S3","optional":false},{"name":"AWS","optional":false},{"name":"CI/CD","optional":false},{"name":"Docker","optional":false},{"name":"GDPR","optional":false},{"name":"IAM","optional":false},{"name":"ISO 27001","optional":false},{"name":"Kubernetes","optional":false},{"name":"Least Privilege","optional":false},{"name":"Node JS","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"PCI DSS","optional":false},{"name":"React.js","optional":false},{"name":"Rest API","optional":false},{"name":"SIEM","optional":false},{"name":"SOC 2","optional":false},{"name":"TCP/IP","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Windows","optional":false},{"name":"JavaScript","optional":true}],"status":"live","first_seen_at":"2026-09-08T13:00:26Z","employer_posted_date":"2026-09-08","last_verified_at":"2026-10-21T20:53:42Z","board_verified":true,"closed_at":null,"days_open":43,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":43},"description":"Job Description - Information Security Lead\nOrganizational Overview\nYanolja Cloud Solution Pvt. Ltd. is a global, end-to-end hospitality technology provider, recognized by Expedia Group among the top 2% of hotel technology companies globally.\nWith more than 400+ team members and 20+ years of experience, YCS currently serves 40,000+ customers across 170+ countries, with 50+ supported languages in our software and a 24/7 support network.\nWe have local teams across 15+ countries, including India, Thailand, Indonesia, Philippines, Sri Lanka, South Africa, Tanzania, Uganda, USA, Mexico, and counting.\nPosition Overview\nWe are looking for an experienced Information Security Lead with a minimum of 10 years of professional experience in cybersecurity and information security to lead and strengthen the security posture of YCS's SaaS products, applications, APIs, cloud infrastructure, internal systems, and customer data.\nThis is a senior technical leadership role requiring a strong combination of application security, API security, AWS/cloud security, incident response, vulnerability management, security architecture, DevSecOps, and security governance.\nThe ideal candidate will be capable of independently investigating complex security incidents, challenging technical architecture, working closely with engineering teams, establishing security standards, and driving security vulnerabilities and risks through remediation and closure.\nThis is not intended to be a purely governance, audit, or SOC-monitoring role. The candidate is expected to remain technically hands-on while providing security leadership across the organization.\nKey Responsibilities\n1. Information Security Ownership\nOwn and continuously improve the overall information security posture of the organization.\nEstablish security priorities based on business risk, customer impact, and technical exposure.\nDevelop and maintain the organization's security roadmap in collaboration with the CTO and engineering leadership.\nAct as the primary technical security authority for product, application, API, cloud, and infrastructure security matters.\nDefine security standards, controls, procedures, and technical guidelines.\nTrack security risks and ensure identified issues are driven to closure.\n2. Application & API Security\nLead security reviews of web applications, APIs, backend services, integrations, and customer-facing platforms.\nIdentify and address vulnerabilities including broken authentication, broken authorization, IDOR/BOLA, injection vulnerabilities, XSS, sensitive data exposure, insecure API endpoints, security misconfigurations, weak session management, and improper tenant isolation.\nEnsure applications follow OWASP Top 10 and OWASP API Security best practices.\nReview authentication and authorization mechanisms including OAuth 2.0, JWT, access tokens, refresh tokens, API keys, service-to-service authentication, and RBAC.\nReview the security of third-party and partner APIs.\nWork directly with engineering teams to remediate security weaknesses.\n3. Multi-Tenant SaaS Security\nReview and strengthen security controls for multi-tenant SaaS applications.\nEnsure proper logical separation of customer and tenant data.\nValidate tenant-level authorization controls across APIs, services, databases, and administrative functions.\nIdentify risks that could allow one customer or hotel to access another customer's information.\nReview authorization architecture for internal systems, customer applications, and third-party integrations.\nEnsure sensitive operations have appropriate access controls and audit trails.\n4. Cloud & AWS Security\nOwn security reviews of AWS infrastructure and cloud architecture.\nReview and improve IAM users, roles and policies, privileged access, security groups, VPC and network architecture, S3 permissions, databases, secrets management, encryption, cloud logging, key management, and publicly exposed services.\nIdentify excessive permissions and privilege-escalation risks.\nEstablish least-privilege access across AWS environments.\nReview cloud architecture before deployment of critical systems.\nWork closely with DevOps and infrastructure teams to remediate cloud security findings.\nEnsure appropriate monitoring and alerting using AWS security services and centralized monitoring platforms.\n5. Security Incident Response & Investigation\nLead investigation of security incidents including suspected customer-data leakage, unauthorized access, credential compromise, malware infections, API misuse, suspicious login activity, cloud compromise, insider threats, and endpoint compromise.\nDetermine incident scope, timeline, root cause, impact, and attack path.\nCoordinate containment, eradication, recovery, and post-incident remediation.\nPerform or coordinate forensic analysis across application, database, API, AWS, endpoint, authentication, and network logs.\nMaintain appropriate evidence and incident documentation.\nConduct post-incident reviews and ensure corrective actions are completed.\nDevelop and maintain incident-response playbooks and escalation procedures.\n6. Vulnerability Management\nOwn the organization's vulnerability-management program.\nEstablish processes for vulnerability identification, prioritization, remediation, verification, and closure.\nManage vulnerabilities identified through penetration testing, SAST, DAST, Software Composition Analysis, cloud-security scans, infrastructure scans, container scans, and security assessments.\nPrioritize vulnerabilities based on severity, exploitability, internet exposure, customer impact, data sensitivity, and business risk.\nDefine vulnerability-remediation SLAs and escalate overdue critical and high-risk vulnerabilities.\nValidate security fixes before closing findings.\nIdentify recurring vulnerability patterns and drive systemic improvements.\n7. Secure SDLC & DevSecOps\nEstablish and mature Secure SDLC practices.\nWork with engineering leadership to embed security throughout product development.\nParticipate in architecture and design reviews for critical features.\nPerform threat modeling for high-risk systems and functionality.\nDefine security requirements before development begins.\nIntegrate automated security controls into CI/CD pipelines, including SAST, DAST, dependency scanning, secret scanning, container scanning, and Infrastructure-as-Code scanning.\nEstablish secure coding guidelines.\nConduct security-focused code reviews when required.\nHelp engineering teams understand security vulnerabilities and remediation techniques.\nEnsure security becomes an engineering responsibility rather than an end-stage compliance activity.\n8. Security Architecture\nConduct security architecture reviews for new products, major product changes, cloud architecture, APIs, third-party integrations, authentication systems, payment integrations, and customer-data workflows.\nIdentify security threats during design rather than after production deployment.\nRecommend preventive, detective, and corrective controls.\nReview trust boundaries, access flows, privilege models, and data flows.\nEnsure security architecture supports scalability without compromising tenant or customer isolation.\n9. Identity & Access Management\nEstablish and review identity and access-management controls.\nEnsure implementation of least privilege, MFA, RBAC, privileged-access management, Joiner-Mover-Leaver processes, and periodic access reviews.\nReview privileged user and administrator activity.\nIdentify shared, dormant, unnecessary, or excessive accounts.\nReview service accounts, API credentials, tokens, and machine identities.\nEnsure credentials are securely generated, stored, distributed, rotated, and revoked.\n10. Security Logging, Monitoring & Detection\nDefine security logging requirements for applications and infrastructure.\nEnsure appropriate logging across APIs, applications, databases, authentication systems, AWS, network infrastructure, and endpoints.\nDefine critical security events that require monitoring.\nImprove SIEM detection and alerting capabilities.\nDevelop use cases for detecting suspicious behavior.\nReview alerts and reduce unnecessary false positives.\nEnsure critical security logs are appropriately retained and protected from unauthorized modification.\n11. Data Security & Privacy\nEnsure sensitive customer and business data is appropriately protected.\nReview encryption at rest and in transit, data masking, tokenization, data retention, data-access controls, backup security, and secrets management.\nEnsure sensitive information is not unnecessarily logged.\nReview how customer information is shared with partners, vendors, OTAs, and external systems.\nInvestigate suspected data-leakage incidents and determine whether exposure occurred internally or externally.\nRecommend controls to minimize unnecessary collection and exposure of sensitive information.\n12. Third-Party & Vendor Security\nLead technical security assessments for third-party vendors and integrations.\nReview security considerations before onboarding technology vendors.\nAssess external API integrations and data-sharing mechanisms.\nEvaluate authentication, authorization, API-key handling, data encryption, credential distribution, and vendor security posture.\nTrack and remediate third-party security risks.\nParticipate in security discussions with enterprise customers and technology partners where required.\n13. Penetration Testing & Security Assessments\nDefine scope and objectives for external and internal penetration-testing exercises.\nCoordinate with penetration-testing vendors.\nReview findings critically rather than accepting scanner or vendor results at face value.\nValidate exploitability and business impact.\nEnsure remediation and retesting are completed.\nPerform targeted technical security assessments internally when required.\n14. Security Governance & Compliance\nSupport security programs aligned with frameworks such as ISO 27001, SOC 2, PCI DSS where applicable, GDPR, and relevant privacy and security regulations.\nMaintain security policies, standards, procedures, and technical controls.\nSupport internal and external audits.\nMaintain security risk registers.\nTrack audit findings, penetration-testing findings, exceptions, and remediation commitments.\nEnsure technical controls operate effectively and are not implemented only for audit purposes.\n15. Security Metrics & Reporting\nDevelop and periodically report meaningful security metrics including:\nCritical and high-risk vulnerabilities\nVulnerability-aging trends\nVulnerability SLA compliance\nMean Time to Detect security incidents\nMean Time to Contain incidents\nMean Time to Remediate vulnerabilities\nRecurring vulnerability trends\nCloud security posture\nSecurity incidents by severity\nSecurity coverage across critical applications\nSecure SDLC adoption\nPenetration-testing closure rate\nOpen security risks\nPrivileged-access review status\nSecurity-control maturity\nPresent major security risks, business impact, and recommendations to senior leadership in clear business language.\nLeadership Responsibilities\nProvide technical leadership to security analysts, engineers, and other security team members.\nMentor junior and mid-level security professionals.\nReview the quality of security investigations and assessments.\nEstablish security-review standards for the team.\nCoordinate across Engineering, DevOps, Infrastructure, QA, Product, IT, Compliance, and management.\nChallenge technical decisions constructively where material security risks exist.\nDrive accountability without creating unnecessary friction between Security and Engineering.\nRequired Experience\nMinimum 10 years of professional experience in Cybersecurity / Information Security.\nSignificant hands-on experience across several of the following areas:Application Security\nAPI Security\nCloud Security\nIncident Response\nVulnerability Management\nSecurity Architecture\nPenetration Testing\nDevSecOps\n\nStrong experience securing SaaS applications.\nStrong understanding of web and AP...","description_format":"text","description_chars":16504,"description_truncated":true,"requirements":{"experience_years_min":10,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Continuous learning"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Travel & Tourism","Hotels & Resorts","Property Management","Application Security"],"lifecycle":[{"event":"open","at":"2026-10-17T23:02:18Z"}],"visa":[],"liveness":{"score":30,"band":"fade","label":"Fading","p_open":1,"p_active":0.675,"p_room":0.45,"age_days":42,"expected_fill_days":28,"reasons":["conf:0","win:tail"],"computed_at":"2026-10-21T05:46:15Z"},"pay":{"stated_usd_annual":25358,"is_top_pay":false},"html_url":"https://alion.io/job/yanoljacloudsolution-head-of-information-security","json_url":"https://alion.io/job/yanoljacloudsolution-head-of-information-security.json","meta":{"generated_at":"2026-10-22T00:08:35Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":220,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-23T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2894890},"rest":"https://alion.io/mcp/rest/get_company?id=2894890"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fyanoljacloudsolution-head-of-information-security"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fyanoljacloudsolution-head-of-information-security"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fyanoljacloudsolution-head-of-information-security"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/yanoljacloudsolution-head-of-information-security\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fyanoljacloudsolution-head-of-information-security"}]}