Senior Business Information Security Officer- Managing Director

MD, Senior Business Information Security Officer (India) The MD, Senior Business Information Security Officer (India) serves as the accountable executive for information security risk management and cyber resilience across India‑based operations. The role ensures adherence to applicable India cyber and data protection regulations while aligning with the global cybersecurity strategy, enterprise risk appetite, and client obligations. The Senior BISO acts as the primary cybersecurity advisor to India executives, regulators, legal entities, risk committees, and business leaders, while coordinating closely with global cybersecurity functions to drive consistent security outcomes and regulatory compliance across the India region. The role balances global cybersecurity standards with regional business and regulatory requirements while driving execution across complex environments. The Senior BISO is expected to operate as a trusted advisor to executive leadership, while being able to translate complex cybersecurity issues into business-oriented risk decisions.

Serve as the senior cybersecurity advisor for local India business teams bringing relevant and actional data so teams can maintain compliance with India cybersecurity and data protection regulations including CERT-In Directions, DPDP Act, RBI, and SEBI. Lead cybersecurity assessments and establish partnerships with business and technology teams to remediate cyber risk in India. Actively work with Operational Risk and Compliance teams to translate India regulations into actionable enterprise security controls aligned with global standards. Manage India cyber risk posture, risk assessments, and material risk reporting into global governance forums. Provide executive risk advisory services and issue escalation recommendations. Senior escalation points for cybersecurity incidents impacting India‑based systems, data, and clients. Support business growth by enabling compliant cloud, digital, outsourcing, and third‑party models within India regulatory requirements. Take an active role in assessing India‑based vendors, service providers, and intra‑group outsourcing arrangements working locally and with global third-party risk management teams. Ensure service providers comply with India regulatory expectations for data localization, logging, monitoring, and incident reporting as part of the global cybersecurity standards. Represent cybersecurity in India executive leadership forums. Required Experience & Qualifications 10+ years in information security / cyber risk, including senior leadership experience in regulated environments. Proven experience operating at a leadership level, engaging regulators, boards, and senior business leadership. Demonstrated hands‑on experience with India cyber regulations, including CERT‑In directives and sector‑specific frameworks. Experience supporting regulatory exams, audits, and enforcement actions in India. Strong preference for financial services, payments, asset management, banking, or similarly regulated industries. Experience in global operating models and matrixed organizations. Technical and Cyber Depth Strong firsthand experience with incident response and crisis management. Thorough understanding of data protection principles and privacy engineering standards. Understanding of Multi-Cloud and SaaS risk models. Experience with architecture patterns and cyber engineering concepts (i.e., Defense in Depth, zero trust, network segmentation, etc.) Control knowledge into identity and access management, logging and monitoring requirements, and cyber resiliency controls. Functional experience with frontier large language Models (LLMs) i.e. GPT, Claude, Gemini, etc. Familiar with threat model applicability (i.e., SDLC integration, security design reviews, etc.) Ability to translate technical risk into executive‑level decision frameworks. Experience with conceptual security processes surrounding Generative AI