Head of Information Security (HIS) - Sahamati

requirements, and industry standards and certifications.

Key Responsibilities

• ISMS Governance & Leadership Establish, implement, maintain, and continually improve the ISMS Define information security policies and standards Ensure integration of ISMS into organisational processes 2. Risk Management Identify, assess, and manage information security risks Define risk appetite in consultation with senior management Maintain the risk register and ensure timely risk treatment Update the information security risk posture to the Information Security Committee 3. Compliance & Regulatory Oversight Ensure compliance with applicable laws, regulations, and standards Drive compliance certification and surveillance audits Coordinate internal and external audits Conduct vulnerability assessment and penetration testing, and ensure remediation of identified vulnerabilities. Ensure third-party/vendor security compliance 4. Security Architecture & Controls Define and enforce security architecture across IT and business systems Ensure implementation of appropriate information security controls 5. Incident Management Establish and maintain an incident response framework Lead response to major security incidents and breaches Ensure root cause analysis and corrective actions Report significant incidents to leadership and the Information Security Committee 6. Security Operations Oversight Security Operations Center(SOC) operations Monitor threats, vulnerabilities, and security events Ensure timely detection and response to threats 7. Business Continuity & Resilience Align with Business Continuity Management (BCM) and Disaster Recovery (DR) standards and build cybersecurity resilience into the Business Continuity Management System (BCMS) process Participate in crisis management 8. Security Awareness & Training Develop organisation-wide security awareness programs Ensure employees understand security policies and responsibilities Promote security culture 9. Third-Party & Supply Chain Security Assess and manage vendor/security risks Ensure contractual security requirements are defined and enforced Conduct vendor audits and reviews 10. Reporting & committees Engagement Provide regular updates to committees on: Information Security posture Information security Risk exposure Security Incident Trends Information security Compliance status Alignment of security risks with business operations 11. Budget & Resource Management Develop and manage a cybersecurity budget Optimise investments in security tools and resources Ensure cost-effective risk mitigation

What We Offer

Opportunity to work at the intersection of technology, finance, and policy in one of India’s most transformative digital ecosystems. Exposure to leading financial institutions, regulators, and innovators shaping the future of consent-based data sharing. A collaborative and purpose-driven work environment that values initiative and learning. Key Skills & Competencies Curious to learn about the AA ecosystem and its stakeholder landscape. Strong knowledge of ISO 27001 and cybersecurity frameworks Information security Risk management expertise Leadership and stakeholder management Incident response and crisis management Regulatory knowledge (e.g., GDPR, local data protection laws) How To Apply Join us in our mission to promote financial inclusion and empower individuals across India through the Account Aggregator ecosystem. Apply now to become a part of our dedicated team! Please submit your resume and cover letter to careers@sahamati.org.in . Please indicate “Head of Information Security (HIS)” in the subject line. Applications will be accepted on a rolling basis, till an appropriate candidate is finalized. Location: Bengaluru (On-site)