Minimum 10 years of professional experience in Cybersecurity / Information Security.
Significant hands-on experience across several of the following areas: Application Security API Security Cloud Security Incident Response Vulnerability Management Security Architecture Penetration Tes
Strong experience securing SaaS applications.
Strong understanding of web and API security.
Strong knowledge of OWASP Top 10 and OWASP API Security Top 10.
Strong understanding of authentication, authorization, access control, and identity management.
Experience working closely with Engineering and DevOps teams.
Experience reviewing penetration-testing findings and driving remediation.
Experience analyzing security logs across application, cloud, database, endpoint, and infrastructure layers.
Good understanding of network-security concepts.
Experience with SIEM, EDR, vulnerability-management, WAF, and application-security tools.
Full description
Job Description – Information Security Lead
Organizational Overview
Yanolja Cloud Solution Pvt. Ltd. is a global, end-to-end hospitality technology provider, recognized by Expedia Group among the top 2% of hotel technology companies globally.
With more than 400+ team members and 20+ years of experience, YCS currently serves 40,000+ customers across 170+ countries, with 50+ supported languages in our software and a 24/7 support network.
We have local teams across 15+ countries, including India, Thailand, Indonesia, Philippines, Sri Lanka, South Africa, Tanzania, Uganda, USA, Mexico, and counting.
Position Overview
We are looking for an experienced Information Security Lead with a minimum of 10 years of professional experience in cybersecurity and information security to lead and strengthen the security posture of YCS's SaaS products, applications, APIs, cloud infrastructure, internal systems, and customer data.
This is a senior technical leadership role requiring a strong combination of application security, API security, AWS/cloud security, incident response, vulnerability management, security architecture, DevSecOps, and security governance.
The ideal candidate will be capable of independently investigating complex security incidents, challenging technical architecture, working closely with engineering teams, establishing security standards, and driving security vulnerabilities and risks through remediation and closure.
This is not intended to be a purely governance, audit, or SOC-monitoring role. The candidate is expected to remain technically hands-on while providing security leadership across the organization.
Key Responsibilities
1. Information Security Ownership
Own and continuously improve the overall information security posture of the organization.
Establish security priorities based on business risk, customer impact, and technical exposure.
Develop and maintain the organization's security roadmap in collaboration with the CTO and engineering leadership.
Act as the primary technical security authority for product, application, API, cloud, and infrastructure security matters.
Define security standards, controls, procedures, and technical guidelines.
Track security risks and ensure identified issues are driven to closure.
2. Application & API Security
Lead security reviews of web applications, APIs, backend services, integrations, and customer-facing platforms.
Identify and address vulnerabilities including broken authentication, broken authorization, IDOR/BOLA, injection vulnerabilities, XSS, sensitive data exposure, insecure API endpoints, security misconfigurations, weak session management, and improper tenant isolation.
Head of Information Security at Yanolja Cloud Solution Pvt. Ltd. (Surat, GJ, India) — aijobsearch
Ensure applications follow OWASP Top 10 and OWASP API Security best practices.
Review authentication and authorization mechanisms including OAuth 2.0, JWT, access tokens, refresh tokens, API keys, service-to-service authentication, and RBAC.
Review the security of third-party and partner APIs.
Work directly with engineering teams to remediate security weaknesses.
3. Multi-Tenant SaaS Security
Review and strengthen security controls for multi-tenant SaaS applications.
Ensure proper logical separation of customer and tenant data.
Validate tenant-level authorization controls across APIs, services, databases, and administrative functions.
Identify risks that could allow one customer or hotel to access another customer's information.
Review authorization architecture for internal systems, customer applications, and third-party integrations.
Ensure sensitive operations have appropriate access controls and audit trails.
4. Cloud & AWS Security
Own security reviews of AWS infrastructure and cloud architecture.
Review and improve IAM users, roles and policies, privileged access, security groups, VPC and network architecture, S3 permissions, databases, secrets management, encryption, cloud logging, key management, and publicly exposed services.
Identify excessive permissions and privilege-escalation risks.
Establish least-privilege access across AWS environments.
Review cloud architecture before deployment of critical systems.
Work closely with DevOps and infrastructure teams to remediate cloud security findings.
Ensure appropriate monitoring and alerting using AWS security services and centralized monitoring platforms.
5. Security Incident Response & Investigation
Lead investigation of security incidents including suspected customer-data leakage, unauthorized access, credential compromise, malware infections, API misuse, suspicious login activity, cloud compromise, insider threats, and endpoint compromise.
Determine incident scope, timeline, root cause, impact, and attack path.
Coordinate containment, eradication, recovery, and post-incident remediation.
Perform or coordinate forensic analysis across application, database, API, AWS, endpoint, authentication, and network logs.
Maintain appropriate evidence and incident documentation.
Conduct post-incident reviews and ensure corrective actions are completed.
Develop and maintain incident-response playbooks and escalation procedures.
6. Vulnerability Management
Own the organization's vulnerability-management program.
Establish processes for vulnerability identification, prioritization, remediation, verification, and closure.
Manage vulnerabilities identified through penetration testing, SAST, DAST, Software Composition Analysis, cloud-security scans, infrastructure scans, container scans, and security assessments.
Prioritize vulnerabilities based on severity, exploitability, internet exposure, customer impact, data sensitivity, and business risk.
Define vulnerability-remediation SLAs and escalate overdue critical and high-risk vulnerabilities.
Validate security fixes before closing findings.
Identify recurring vulnerability patterns and drive systemic improvements.
7. Secure SDLC & DevSecOps
Establish and mature Secure SDLC practices.
Work with engineering leadership to embed security throughout product development.
Participate in architecture and design reviews for critical features.
Perform threat modeling for high-risk systems and functionality.
Define security requirements before development begins.
Integrate automated security controls into CI/CD pipelines, including SAST, DAST, dependency scanning, secret scanning, container scanning, and Infrastructure-as-Code scanning.
Establish secure coding guidelines.
Conduct security-focused code reviews when required.
Help engineering teams understand security vulnerabilities and remediation techniques.
Ensure security becomes an engineering responsibility rather than an end-stage compliance activity.
8. Security Architecture
Conduct security architecture reviews for new products, major product changes, cloud architecture, APIs, third-party integrations, authentication systems, payment integrations, and customer-data workflows.
Identify security threats during design rather than after production deployment.
Recommend preventive, detective, and corrective controls.
Review trust boundaries, access flows, privilege models, and data flows.
Ensure security architecture supports scalability without compromising tenant or customer isolation.
9. Identity & Access Management
Establish and review identity and access-management controls.
Ensure implementation of least privilege, MFA, RBAC, privileged-access management, Joiner-Mover-Leaver processes, and periodic access reviews.
Review privileged user and administrator activity.
Identify shared, dormant, unnecessary, or excessive accounts.
Review service accounts, API credentials, tokens, and machine identities.
Ensure credentials are securely generated, stored, distributed, rotated, and revoked.
10. Security Logging, Monitoring & Detection
Define security logging requirements for applications and infrastructure.
Ensure appropriate logging across APIs, applications, databases, authentication systems, AWS, network infrastructure, and endpoints.
Define critical security events that require monitoring.
Improve SIEM detection and alerting capabilities.
Develop use cases for detecting suspicious behavior.
Review alerts and reduce unnecessary false positives.
Ensure critical security logs are appropriately retained and protected from unauthorized modification.
11. Data Security & Privacy
Ensure sensitive customer and business data is appropriately protected.
Review encryption at rest and in transit, data masking, tokenization, data retention, data-access controls, backup security, and secrets management.
Ensure sensitive information is not unnecessarily logged.
Review how customer information is shared with partners, vendors, OTAs, and external systems.
Investigate suspected data-leakage incidents and determine whether exposure occurred internally or externally.
Recommend controls to minimize unnecessary collection and exposure of sensitive information.
12. Third-Party & Vendor Security
Lead technical security assessments for third-party vendors and integrations.
Review security considerations before onboarding technology vendors.
Assess external API integrations and data-sharing mechanisms.
Evaluate authentication, authorization, API-key handling, data encryption, credential distribution, and vendor security posture.
Track and remediate third-party security risks.
Participate in security discussions with enterprise customers and technology partners where required.
13. Penetration Testing & Security Assessments
Define scope and objectives for external and internal penetration-testing exercises.
Coordinate with penetration-testing vendors.
Review findings critically rather than accepting scanner or vendor results at face value.
Validate exploitability and business impact.
Ensure remediation and retesting are completed.
Perform targeted technical security assessments internally when required.
14. Security Governance & Compliance
Support security programs aligned with frameworks such as ISO 27001, SOC 2, PCI DSS where applicable, GDPR, and relevant privacy and security regulations.
Maintain security policies, standards, procedures, and technical controls.
Support internal and external audits.
Maintain security risk registers.
Track audit findings, penetration-testing findings, exceptions, and remediation commitments.
Ensure technical controls operate effectively and are not implemented only for audit purposes.
15. Security Metrics & Reporting
Develop and periodically report meaningful security metrics including:
Critical and high-risk vulnerabilities
Vulnerability-aging trends
Vulnerability SLA compliance
Mean Time to Detect security incidents
Mean Time to Contain incidents
Mean Time to Remediate vulnerabilities
Recurring vulnerability trends
Cloud security posture
Security incidents by severity
Security coverage across critical applications
Secure SDLC adoption
Penetration-testing closure rate
Open security risks
Privileged-access review status
Security-control maturity
Present major security risks, business impact, and recommendations to senior leadership in clear business language.
Leadership Responsibilities
Provide technical leadership to security analysts, engineers, and other security team members.
Mentor junior and mid-level security professionals.
Review the quality of security investigations and assessments.
Establish security-review standards for the team.
Coordinate across Engineering, DevOps, Infrastructure, QA, Product, IT, Compliance, and management.
Challenge technical decisions constructively where material security risks exist.
Drive accountability without creating unnecessary friction between Security and Engineering.
Required Experience
Minimum 10 years of professional experience in Cybersecurity / Information Security.
Significant hands-on experience across several of the following areas:
Application Security
API Security
Cloud Security
Incident Response
Vulnerability Management
Security Architecture
Penetration Testing
DevSecOps
Strong experience securing SaaS applications.
Strong understanding of web and API security.
Strong knowledge of OWASP Top 10 and OWASP API Security Top 10.