The Chief Information Security Officer (CISO) is responsible for developing, implementing, and managing the organization’s security vision, strategy, and programs. This dynamic executive role involves leading proactive measures to protect all assets, information, and personnel from potential threats, both defined and undefined. The CISO will collaborate closely with other executive team members to ensure a comprehensive security posture that aligns with the organization's objectives, balancing rapid product innovation with effective risk management.
What You’ll Do:
-
Develop and Implement Security Strategies: Design and execute comprehensive security strategies and policies to protect the organization’s assets, including products, platforms, digital, and human resources.
-
Proactive Threat Monitoring: Establish and lead a 24/7 Security Operations Center (SOC) for continuous monitoring and real-time threat intelligence, enabling rapid response to emerging threats.
-
Bug Bounty and Ethical Hacking Programs: Launch and manage bug bounty programs and regular ethical hacking exercises to identify and remediate vulnerabilities in applications and infrastructure.
-
Risk Management and Mitigation: Partner with Risk leadership to develop and implement a comprehensive risk management framework. This includes assessing, prioritizing, and mitigating risks across the organization, with a focus on data protection, fraud prevention, and product features that protect customers.
-
Balancing Security and Product Functionality: Work closely with product development teams to integrate security into the product development lifecycle. Ensure that security measures are designed to protect data and systems while enabling product innovation and functionality.
-
Cross-Functional Coordination: Collaborate with IT, legal, compliance, and other departments to ensure a unified and agile response to security threats, fostering cross-functional collaboration and alignment.
-
Leadership and Empowerment: Provide leadership, direction, and guidance to the security team, fostering a culture of security awareness and continuous learning. Empower team members to take decisive action in response to uncertain threats.
-
Real-Time Data Analytics: Leverage advanced analytics and threat intelligence to drive informed decision-making and prioritize security actions based on potential risk.
-
Incident Response and Crisis Management: Develop, test, and lead incident response plans and exercises to ensure the organization is prepared for all potential security incidents, including undefined threats.
-
Security Awareness and Training: Foster a culture of security awareness through the development and delivery of regular training programs for employees, emphasizing agility in response to evolving threats.
-
Innovation and Continuous Improvement: Encourage innovative solutions to complex security challenges and promote a culture of continuous improvement through feedback loops and learning from experience.
What We're Looking For:
-
Technical Background: Deep understanding of information security, risk management, and compliance. Previous experience leading a technical/engineering organization is strongly preferred..
-
Business Acumen: Strong understanding of business operations and ability to communicate effectively with stakeholders, including board members and executives. An MBA or related advanced degree is beneficial.
-
Leadership and Management: Proven track record in managing teams, developing security strategies, and collaborating with cross-functional teams. Experience in managing security incidents at company level and implementing security measures.
-
Certifications and Education: CISSP, CISM, CISA, or similar certifications preferred. Bachelor's degree in Computer Science, Cybersecurity, or a related field is required; a Master’s degree is preferred.
-
Risk Management: Experience in developing and implementing risk management strategies that align with business goals. Experience with security frameworks like NIST or ISO 27001 is strongly preferred.
-
Compliance and Regulatory: Knowledge of regulatory requirements such as GDPR, DPDP, and PCI-DSS, and ability to ensure compliance with these standards.
-
AI and Emerging Technologies: Understanding of AI and other emerging technologies and their security implications, with the ability to develop strategies to mitigate associated risks.
-
Communication and Collaboration: Ability to communicate complex technical issues to non-technical stakeholders and collaborate effectively across teams.
