Information Security Associate

As a member of the Information Security Team at Glomopay, you will own the entire information security function — from policy and governance to hands-on implementation and regulatory compliance. Reporting directly to the Head of Information Security, this is a strategic role for a security practitioner who can single-handedly stand up a mature InfoSec program for Glomo Key Responsibilities Security Governance & Compliance Own the Information Security Management System (ISMS) — policy framework, risk assessments and control implementation aligned with ISO 27001, PCI DSS, and IFSCA Cyber Security and Cyber Resilience Framework Lead compliance with RBI outsourcing directions, IFSCA circulars, DPSC guidelines, and PCI SSF requirements applicable to payment service providers Own third-party risk management — conduct due diligence audits on all technology partners and maintain records per regulatory requirements Drive the internal IT audit program — plan, execute, engage external audit vendors, and track findings to closure Establish the Information Classification framework, embedding it into DLP rules, employee training, and daily operations Security Operations & Architecture (Hands-On) Build and manage the SOC function — starting with MDR-augmented operations (CrowdStrike), progressively maturing toward hybrid capability Own the SIEM strategy: integrate and monitor all critical log sources (application, infrastructure, database, identity, PAM) and build detection use-cases Conduct threat modelling Manage Privileged Access Management (PAM) — session monitoring, password rotation,break-glass procedures, periodic user access reviews Implement and manage DLP controls across endpoints, email, and cloud storage (Google Workspace DLP, CrowdStrike Device Control) Own endpoint security — hardening SOPs against CIS benchmarks, approved software lists, full disk encryption Drive network security posture — geo-fencing, firewall rule reviews, Cloud IDS tuning across GCP infrastructure Oversee application security — integrate SAST/DAST into CI/CD pipelines, define security review thresholds, manage OWASP compliance Incident Management & Business Continuity Own the incident management lifecycle — severity classifications, closure SLAs, escalation procedures, post-incident reviews Establish a dedicated security incident reporting channel and ensure organization-wide awareness Maintain and test the Business Continuity Plan covering office unavailability, power failure, pandemic, and cloud provider disruption scenarios Ensure DR drills meet RTO thresholds with proper segregation of duties Serve as the primary point of contact during security incidents, coordinating response with banking partners and regulators per notification SLAs Regulatory & Partner Interface Serve as the primary security interface with banking partners, managing their Third Party Service provider Risk Assessments Build the “Managed Security Transparency” program — scoped security reports, alert forwarding, incident summaries, and independent attestation for regulated entity partners Coordinate with IFSCA, external auditors, and banking partner audit teams during inspections and certifications Drive the SOC 2 Type II certification journey and maintain independent attestations (ISO 27001, PCI DSS) Build and maintain a compliance resource center — audit reports, certifications, security documentation available for partner due diligence on demand What We're Looking For Experience: 4 years in information security with at least 3 years in a hands-on security role, preferably in regulated financial services (fintech, banking, NBFC, payment processors) Core Expertise: Be part of the InfoSec program from the early stage, understand the GRC as well as the Security Function. Deep working knowledge of PCI DSS, ISO 27001, SOC 2, and Indian financial regulatory frameworks (RBI, IFSCA) Hands-on with experience with cloud security on GCP (strongly preferred) or AWS/Azure Experience on both sides of third-party security assessments — being audited and auditing vendors Practical expertise in PAM, SIEM, DLP, endpoint hardening, and network security. The Right Person For This Role: You should be able to make sense of SIEM detection rules and alerts and configure the same as well Translates regulatory requirements into practical controls without over-engineering Holds firm on security non-negotiables while being pragmatic with business constraints Writes clean policy documents, audit responses, and regulatory submissions Thrives solo in a fast-paced startup where compliance is a competitive advantage, not overhead High integrity — this role has access to the most sensitive systems, data, and partner relationships Ability to handle audits and provide right and logical justifications where appropriate. Why Join Glomopay? Direct Impact: Report directly to the Head of Information Security. Shape the security foundation of India's first IFSCA-authorized PSP, your actions and decisions define the ecosystem. Full Ownership: You will be instrumental in building the entire security program and be a part of the team from scratch. No inherited mess, no bureaucracy — This gives you an opportunity to define the culture from scratch. Regulatory Pioneer: You will help define the InfoSec playbook at the intersection of IFSCA, RBI, and global card network requirements. Modern Stack: GCP, Terraform IaC, CrowdStrike, Teleport PAM — cloud-native infrastructure, not legacy systems. Strategic Moat: Your security program becomes the reason banking partners choose Glomopay. Security here is a revenue enabler, not a cost center.