Unit Manager /Senior Unit Manager - Information Security

Job Purpose

Cyber Risk Unit - Role Objective

• Lead and govern Cyber Risk Unit BAU operations and strategic security projects covering API security, assurance, vulnerability management, external threat monitoring, brand protection and secure change governance.
• Drive risk-based prioritisation, control effectiveness, issue closure, stakeholder governance, management reporting and regulatory or audit readiness across assigned cyber-risk domains.

Duties and Responsibilities BAU Responsibilities API Governance and API Monitoring

• Own the enterprise API security governance framework, standards, control requirements, exception process and operating procedures.
• Maintain visibility of APIs across gateways, applications and business units, including ownership, exposure, authentication method, data classification and lifecycle status.
• Monitor API security events, anomalous usage, authentication failures, sensitive-data exposure patterns and control deviations; coordinate investigation and remediation.
• Conduct periodic governance reviews with API owners and track gaps, exceptions, ageing and closure within agreed timelines.

API Audit

• Plan and coordinate risk-based API audits covering design, authentication, authorisation, encryption, logging, rate limiting, secrets, data handling and third-party exposure.
• Maintain evidence, observations, root-cause details, action plans and closure validation for internal, external and regulatory audits.
• Assess compliance with approved API standards and applicable OWASP API Security risks; present material findings to relevant governance forums.

VAPT - Web, Mobile Application and API

• Govern end-to-end VAPT for web applications, Android/iOS mobile applications and APIs across pre-production, production and major-change scenarios.
• Ensure scope finalisation, testing coordination, report quality review, severity validation, false-positive disposition, retesting and formal closure.
• Track vulnerabilities by severity, asset criticality, exploitability, internet exposure and business impact; escalate overdue or high-risk items.
• Coordinate with application, engineering, infrastructure, cloud, product and vendor teams for remediation and compensating controls.

Dark Web Monitoring

• Oversee monitoring for leaked credentials, exposed customer or employee data, source code, access tokens, confidential documents and threat-actor references.
• Validate alerts, assess impact, initiate containment and takedown workflows, and coordinate incident escalation with SOC, fraud, legal and business teams as applicable.
• Maintain trend reporting, recurring exposure analysis and closure evidence.

Brand Protection

• Monitor and coordinate action against phishing domains, fake applications, social-media impersonation, fraudulent advertisements, counterfeit websites and misuse of company trademarks.
• Drive validation, takedown, evidence preservation, stakeholder notification and closure tracking with internal teams and external service providers.
• Report brand-abuse trends, high-impact campaigns and repeat infrastructure to management.

SMT Monitoring

• Govern Security Misconfiguration Tracking (SMT) and related monitoring for security-control deviations, exposed services, configuration weaknesses and recurring hygiene issues.
• Validate findings with asset owners, assign risk and remediation timelines, track ageing, and escalate persistent or critical issues.
• Analyse recurring patterns and recommend preventive controls, automation and ownership improvements.

DevSecOps Change Management

• Embed security checks in change-management and CI/CD workflows for new releases, emergency changes and material architecture changes.
• Review security impact, required testing, open vulnerabilities, exceptions and approvals before production deployment.
• Coordinate SAST, DAST, SCA, secrets scanning, container or IaC checks and VAPT evidence, based on change risk and applicability.
• Monitor post-deployment security observations and ensure lessons learned are incorporated into development standards.

Cross-functional Governance AND Reporting

• Prepare and publish operational dashboards, KRIs, KPIs, ageing reports, risk-acceptance status, audit updates and project health summaries for leadership.
• Facilitate governance meetings with technology, product, business, SOC, infrastructure, cloud, fraud, compliance, legal, procurement and third-party stakeholders.
• Manage the cyber-risk remediation lifecycle, including ownership, target dates, evidence review, closure validation and escalation.
• Support policy, standard, SOP and control-library updates for assigned Cyber Risk Unit processes.
• Support regulatory inspections, internal audits, external audits and management reviews by providing accurate records and control evidence.
• Identify automation opportunities for monitoring, workflow, evidence collection, reporting and risk-based prioritisation.
• Mentor team members, review deliverable quality and ensure consistent operating practices across BAU activities.

Project / Initiative Expected Contribution

• API Discovery and Inventory Improvement: Establish a reliable API inventory, ownership model, risk classification and lifecycle controls across business and technology platforms.
• API Security Monitoring Enhancement: Improve use cases, alert quality, dashboards, integrations and response workflows for API threats and anomalies.
• Enterprise VAPT Governance Optimisation: Standardise scope, testing methodology, reporting, SLA tracking, retesting, exceptions and risk-based prioritisation.
• Dark Web and Brand Protection Uplift: Enhance monitoring coverage, validation, takedown workflows, escalation paths, provider governance and executive reporting.
• DevSecOps Security Gate Integration: Integrate proportionate security controls and evidence requirements into CI/CD and enterprise change-management processes.
• Cyber Risk Dashboard and Workflow Automation: Automate data ingestion, quality checks, ageing, escalations, metrics and management views across CRU processes.
• Control Rationalisation and Audit Readiness: Map operational controls to policies, standards and audit requirements; remove duplication and strengthen evidence quality.
• Third-Party Security Assurance: Coordinate security assessments and remediation governance for service providers supporting APIs, applications and monitoring services.

Key Competencies

• Strong ownership, analytical thinking and risk-based decision-making.
• Ability to lead security discussions with engineering, product, business and senior-management stakeholders.
• Effective programme management across concurrent BAU and project deliverables.
• Strong written communication, documentation, governance and presentation skills.
• Ability to challenge constructively, manage conflict, drive closure and maintain audit-quality evidence.
• Ability to mentor team members and improve process maturity through standards, automation and measurable outcomes.

Required Qualifications and Experience Education and Experience

• Engineering graduate or equivalent qualification with 6-10 years of relevant experience in Cyber Security, Application Security, Vulnerability Management, Technology Risk or Cyber Risk Operations.
• Hands-on experience in API security governance, VAPT governance, security monitoring, audit coordination and remediation management.
• Experience in a regulated financial-services, banking, NBFC or large enterprise environment is preferred.
• Demonstrated experience in managing multiple BAU workstreams and security-transformation projects with cross-functional stakeholders.

Technical and Security Skills

• Strong understanding of web, mobile and API security, OWASP Top 10, OWASP API Security Top 10, common authentication and authorisation patterns, and secure SDLC practices.
• Working knowledge of API gateways, WAF, SIEM, application-security testing tools, CI/CD security controls, threat intelligence and external attack-surface monitoring.
• Ability to assess vulnerability severity, exploitability, business impact, compensating controls and remediation evidence.
• Understanding of audit, risk acceptance, exception management, control testing, incident coordination and regulatory evidence requirements.
• Advanced reporting and analytical skills, including dashboard design, trend analysis, metrics definition and executive communication.