Chief Information Security Officer (CISO)

About Evaratus (Scaler AI Labs)

Evaratus partners with frontier AI companies on RL environments, evaluation systems, and expert-curated data. We are around 150 people in one Bengaluru office and growing fast, with a US parent entity and customers who are among the most security-conscious organisations in the world.

About the role

You are our first Chief Information Security Officer. The mandate has two halves and you are judged on both.

First, the systems. Our customers hand us sensitive data and proprietary environments, and our own work product is valuable to anyone who wants to get at it. You make the probability of a successful attack on Evaratus genuinely low, and you can show your reasoning and your evidence for that claim to a customer, an auditor, or the board.

Second, the people. A 150-person company does not stay secure because one person is vigilant. It stays secure because everyone treats security as part of doing good work. You build that culture: the habits, the defaults, the training, and the tone from the top.

You are not inheriting a mature programme. There is a real foundation (SSO across our core systems, device management, access reviews, a growing evidence trail) and a long list of things that are not yet where they should be. You will set the strategy, do a large share of the hands-on work yourself in the first year, and build the small team around you as the company grows.

This is a role for someone whose career has moved much faster than the usual ladder. We are deliberately looking for a prodigy, not a veteran: someone with fewer than ten years behind them who has already been trusted with real security ownership, and for whom this is the job that makes them a CISO.

You report to the founders.

What you will own

• Security strategy and posture. A threat model that is specific to what we do, a prioritised roadmap against it, and a quarterly, honest readout to leadership of where we are exposed and what it costs to fix.

• Identity and access. Single sign-on everywhere, phishing-resistant MFA, least privilege, tight control of administrator roles, and joiner, mover and leaver flows that leave no lingering access across Google Workspace, GitHub, Slack, cloud and our SaaS estate.

• Endpoint and network. Every laptop managed, encrypted, patched and covered by EDR, with the ability to lock or wipe a lost device within the hour. A segmented, well-defended office network.

• Cloud and product security. Secure configuration of our GCP and other cloud estates, secrets management, secure SDLC, dependency and supply-chain hygiene, and regular penetration testing with findings actually closed.

• Data protection. Classification, handling and retention rules for customer data and PII, including the environments where we scrub and transform data before delivery. Encryption, isolation, and logging that would let us prove who touched what.

• Detection and response. Centralised logging, alerting that a human reads, a written incident response plan that has been exercised, and a post-incident practice that fixes root causes.

• Compliance and customer trust. Take us through SOC 2 Type II and ISO 27001. Own security questionnaires, customer audits and the security terms in our commercial agreements, so that our security programme helps close deals rather than slow them.

• Vendor and SaaS risk. Know every third party that holds our data, assess them proportionately, and reclaim access that is no longer needed.

• Security culture. Onboarding that sets expectations on day one, regular training that people do not resent, phishing simulations, security champions inside engineering and operations, and a reporting culture where raising a concern early is rewarded.

• Team. Hire and lead a small security team as the company grows, and work closely with our IT Administrator, who runs the device fleet and network day to day.

What we are looking for

We care more about calibre and judgement than about years served. If you are strong, we will pay for it.

• Exceptional raw ability. You learn new domains fast, reason from first principles, and are comfortable being the smartest person in the room on a topic you picked up last month

• Pedigree that reflects that ability. Educated at a top-tier institution and a track record at companies known for a high bar, where security was taken seriously because it had to be

• Fewer than ten years of experience, and a career that has moved unusually fast. Promoted multiple times, handed scope well beyond your years, trusted with security ownership early. We look at the slope, not the total

• Has already owned security end to end at some level: as Head of Security, security lead or first security hire at a fast-growing company, or as the person a CISO leaned on to actually run the programme

• Genuinely technical. You can read code, review a cloud IAM policy, interpret an EDR alert and argue with an engineer about a threat model, not just manage people who do

• Has built a security programme from an early stage rather than only run a mature one, and can talk through exactly what was weak, what you fixed first and why

• Has taken a company through SOC 2 Type II or ISO 27001, or has run customer security reviews from demanding enterprises

• Has led at least one real incident response and is honest about what went wrong

• Communicates clearly with non-technical leadership, and can make security feel like enablement rather than friction for 150 smart, fast-moving people

• Based in Bengaluru and happy to work from the office

Nice to have

• Security leadership experience, with or without the CISO title, in fintech, payments, banking, healthcare or another regulated, high-sensitivity domain

• Experience protecting AI or ML systems and large datasets, including data provenance, PII handling and model or environment IP

• Exposure to a company with both an Indian entity and a US parent, and to the security expectations of US enterprise customers

• Certifications such as CISSP, CISM, OSCP or cloud security certifications. Useful, not required

How we will assess you

A practical conversation, not a slide review. We will describe our systems, our customers and our data flows as they actually are, and ask you to build the threat model on the spot, tell us the three things you would fix in your first month, and explain how you would get 150 people to care about them.