Senior Manager - Information Security
Posted 1
view
Summary
Hands-on security leadership role at a rural-lending fintech: build and own the information security strategy, GRC/audit program (RBI, DPDP Act 2023, ISO 27001, CERT-In, VAPT), and technical posture across AWS cloud, applications, APIs and field-force mobile. Reports to the CTPO; work from office in Baner, Pune.
About the Role
SarvaGram is building out its information security leadership bench as the organisation scales. We are looking for a
Senior Manager - Information Security who combines genuine technical depth with regulatory fluency specific to
the lending/NBFC domain. This is a hands-on, build-from-the-ground-up role - not a steady-state operator position -
for someone who wants to own security strategy, audit readiness, and technical posture for a fast-growing regulated
fintech.
Reports to: Chief Technology & Product Officer (CTPO)
Location: Baner, Pune
Mode: Work from Office
Experience: 8-12 years
Requirements
● Define and own enterprise information security strategy and roadmap, aligned to business growth and
regulatory expectations (RBI IT Governance & Risk Controls, Digital Lending Guidelines, DPDP Act 2023).
● Build and mature the organisation's security posture across cloud infrastructure (AWS), applications, APIs,
and the field-force mobile ecosystem.
● Own the end-to-end audit management lifecycle: VAPT (Server, API, Application), internal and external IS
audits, CERT-In empanelled engagements, evidence collection, and remediation tracking.
● Build and operationalise GRC artefacts: risk registers, Information Asset Register, BCP/DR documentation,
and data localisation tracking.
● Partner with engineering squads to embed security-by-design into the SDLC and release governance
process (change management, CAB/PIR).
● Drive DPDP Act compliance: consent architecture, breach-notification readiness, and vendor data
processing agreement (DPA) due diligence.
● Provide hands-on technical leadership - security architecture reviews, threat modelling, and incident
response - rather than operating purely at a policy level.
● Represent the security function credibly in front of auditors, regulators, and senior leadership as required.
Key Responsibilities
● Define and own enterprise information security strategy and roadmap, aligned to business growth and
regulatory expectations (RBI IT Governance & Risk Controls, Digital Lending Guidelines, DPDP Act 2023).
● Build and mature the organisation's security posture across cloud infrastructure (AWS), applications, APIs,
and the field-force mobile ecosystem.
● Own the end-to-end audit management lifecycle: VAPT (Server, API, Application), internal and external IS
audits, CERT-In empanelled engagements, evidence collection, and remediation tracking.
● Build and operationalise GRC artefacts: risk registers, Information Asset Register, BCP/DR documentation,
and data localisation tracking.
● Partner with engineering squads to embed security-by-design into the SDLC and release governance
process (change management, CAB/PIR).
● Drive DPDP Act compliance: consent architecture, breach-notification readiness, and vendor data
processing agreement (DPA) due diligence.
● Provide hands-on technical leadership - security architecture reviews, threat modelling, and incident
response - rather than operating purely at a policy level.
● Represent the security function credibly in front of auditors, regulators, and senior leadership as required.
What We're Looking For
● 8+ years in information security, with demonstrable exposure to BFSI/NBFC/fintech regulatory requirements
(RBI, DPDP, IT Act).
● A track record of building or substantially maturing a security program - not only operating controls
someone else designed.
● Working knowledge of ISO 27001, NIST, VAPT lifecycles, and CERT-In requirements.
● Genuine hands-on technical depth across cloud security (AWS preferred), application security, and
network/infrastructure security.
● Strong communication skills - comfortable translating technical risk into business and regulatory language
for senior stakeholders.
● Prior exposure to digital lending or similar regulated consumer-lending businesses is a strong plus
Benefits
SarvaGram is on a mission to revolutionize financial services for millions in rural India. We're building the nation's first data-driven platform that combines cutting-edge technology with a human touch to unlock financial possibilities for underserved households.
This is your chance to be at the forefront of innovation. Join us and:
• Shape the future of FinTech: We're not just building a product, we're creating a new category. Be a part of defining the future of financial inclusion for rural India.
• Embrace a high-growth, high-impact environment: This is a non-linear growth opportunity. Build a platform used by millions and witness the network effect drive massive scale.
• Tackle real-world challenges: Apply your skills to solve critical problems and directly empower rural communities.
• Craft solutions that touch lives: Develop innovative products used by diverse household members, each with unique needs