& Summary

The CISO & DPO is a senior leadership role (Senior Director level) accountable for leading the organization’s cyber security strategy, information security governance, and data protection operations. The role is split equally (50/50) between cyber security leadership and privacy governance. The incumbent will own the CISO office agenda, strengthen enterprise security posture, drive NIS and information security control implementation, and ensure alignment with the DPDP Act. This position requires a strategic leader capable of influencing executive stakeholders and managing cross-functional teams across technology, business, legal, and risk departments.

Responsibilities

• Define and lead cyber security strategy, operating models, and governance routines. Drive continuous improvement across security and privacy processes, playbooks, and SOPs.

• Oversee incident response, vulnerability management, DLP, security exceptions, and remediation tracking.

• Lead DPDP Act 2023 compliance, privacy risk assessments (DPIA/DPRA), data principal rights governance, and privacy incident coordination.

• Mentor and develop multi-disciplinary teams. Manage cross-functional working groups involving IT, Legal, Risk, and business units.

• Sponsor and oversee compliance programs (ISO 27001, ISO 22301, SOC 2) and ensure security/privacy-by-design in new projects and technology rollouts.

• Provide executive-level reporting on cyber risk, incident trends, regulatory readiness, and remediation status.

Mandatory skill sets

• Ability to set enterprise cyber security strategy and operating models, and measure outcomes.

• Expertise in coordinating assessments, evidence packs, and remediation plans for security and privacy controls.

• Capability to oversee incident triage, escalation, and root-cause tracking.

• Deep understanding of DPDP compliance, data rights, and privacy-by-design integration.

• Proven leadership ability to influence executive stakeholders and build cross-functional alignment.

• Ability to advise project/product teams on NIS controls and go-live readiness.

Preferred skill sets

• Hands-on experience with ISO 27001, ISO 22301, SOC 2, and CIS controls frameworks.

• Experience in business continuity planning (BCP), crisis management, and third-party/product security.

• Strong executive communication skills and experience engaging with external assurance/regulatory interfaces.

Years of experience required

20–25 years of overall experience in information security, cyber risk, technology risk, security governance, IT risk management, privacy governance, or regulatory compliance.

Education qualification

• Bachelor's degree in Engineering, Computer Science, Information Systems, Cyber Security, Risk Management, or related discipline (essential).

• Postgraduate qualification (desirable).

• Preferred certifications include CISSP, CISM, CISA, CRISC, ISO 27001 Lead Implementer/Lead Auditor, ISO 22301, CCSP, or CIPM.

• Executive leadership, crisis management, and program governance training are desirable.

Top of Form

Bottom of Form