Security Manager

Job Summary

We are looking for a Manager, IT & Security to build, operate, and scale a secure, resilient, and audit-ready technology environment - with equal ownership across enterprise IT and information security.

Reporting to the COO, this is a builder-operator role. You will be hands-on in designing systems and processes while simultaneously building the team and structure to scale them. You will own the full spectrum - from internal infrastructure and endpoint management to security engineering, compliance programs, AI security governance, data protection (including DPO responsibilities), and the customer-facing trust posture that enables enterprise revenue.

This role carries a unique advantage and responsibility: you will be securing an organization whose own products - ZTNA, MFA, SSO, virtualization, MDM, biometric authentication, and a secure OS - are the building blocks of enterprise security. That means dogfooding our stack, shaping product security from the inside, and representing our security posture to customers who evaluate us as both a vendor and a security partner.

You will build a defensible security architecture aligned with our product philosophy - secure-by-design digital workspace, identity-first access, and zero-trust principles - while keeping the organization ahead of an evolving threat landscape shaped by AI-driven attacks, software supply chain risks, and increasingly sophisticated adversaries.

Core Ownership Areas

• Internal IT and infrastructure
• Security engineering and operations
• AI and emerging technology security
• Data protection and privacy (DPO)
• Compliance and certification programs
• Product and platform security
• Customer and regulator-facing security posture

Key Responsibilities

1. Enterprise IT & Infrastructure Leadership

• Own and scale global IT operations - end-user computing, networks, cloud infrastructure, and office IT for a distributed workforce.
• Dogfood our own product stack (ZTNA, MFA, SSO, MDM, virtualization) as the foundation of internal IT architecture - serving as both a validation environment and a reference implementation for customers.
• Design secure, identity-driven enterprise architecture with conditional access, device posture enforcement, and zero-trust segmentation.
• Drive adoption of zero-trust and least-privilege models across all infrastructure layers.
• Ensure high availability, performance, and resilience of internal systems with defined SLA targets.
• Implement cloud security posture management (CSPM) and cloud workload protection (CWPP) across cloud environments.

2. Security Strategy & Operations

• Define and execute the organizations information security strategy, aligned to business objectives and the evolving threat landscape.
• Build and lead capabilities across:
• Security operations center (SOC) - with AI-augmented monitoring, detection, and response.
• Vulnerability management and patching with defined SLA-driven remediation timelines.
• Identity and access governance across internal and product environments.

• Establish threat-informed defense models aligned to frameworks like MITRE ATT&CK.
• Deploy and evolve AI-native security tooling for automated threat detection, anomaly identification, and intelligent alerting to reduce analyst burden and improve response times.

3. AI & Emerging Technology Security

• Own the security governance framework for AI/ML usage across the organization - both internal tools and product-embedded capabilities.
• Address AI-specific threat vectors including:
• LLM-assisted phishing and deepfake-based social engineering.
• Prompt injection, data exfiltration via AI tools, and model manipulation risks.
• Shadow AI usage and ungoverned adoption of generative AI by employees.

• Define acceptable use policies and technical controls for AI tools (e.g., data classification rules for LLM inputs, approved tool lists, access controls for model endpoints).
• Evaluate and integrate AI-driven capabilities into the security operations stack - automated triage, behavioral analytics, predictive threat intelligence.
• Stay current on regulatory developments related to AI governance and data protection (e.g., EU AI Act, emerging regional frameworks).

4. Product & Platform Security

• Partner with engineering to embed secure SDLC practices with security gates at each stage of the development lifecycle.
• Drive security architecture reviews across the product portfolio, with particular focus on:
• Authentication and authorization layers (MFA, SSO, biometric authentication).
• ZTNA and VPN / VDI / workspace access components.
• MDM and endpoint management services.
• Secure OS and USB-based deployment surfaces.
• API and cloud-native services.

• Implement and mature:
• SAST, DAST, SCA, and SBOM practices with automated integration into CI/CD pipelines.
• Threat modeling (STRIDE or equivalent) as a standard practice for new features and architecture changes.

• Own software supply chain security - dependency integrity, build pipeline security, and provenance verification.
• Act as the internal authority on customer-facing product security posture - particularly critical given that our products are themselves security tools evaluated by CISOs and security teams.

5. Data Protection, Privacy & Security (DPO)

• Serve as the organizations Data Protection Officer (DPO), with accountability for data privacy compliance across all 12 operating countries.
• Define and enforce data classification, data loss prevention (DLP), and encryption strategies (at rest, in transit, and in use) - across products and internal systems.
• Partner with product and engineering to embed privacy-by-design principles, particularly for products handling customer identity and access data.
• Own data protection impact assessments (DPIAs) for new products, features, and data processing activities.
• Ensure alignment between data handling practices and regulatory requirements across all operating geographies (GDPR, Indias DPDP Act, and regional data protection laws).
• Own data retention, anonymization, and cross-border data transfer policies - including standard contractual clauses (SCCs) and binding corporate rules where required.
• Act as the primary point of contact for data protection authorities across jurisdictions.

6. Compliance, Risk & Governance

• Lead and maintain certifications such as ISO/IEC 27001, SOC 2 Type II, and regional regulatory requirements across operating geographies.
• Build audit-ready evidence frameworks - automated where possible - to reduce certification overhead and audit preparation time.
• Manage:
• Risk assessments (enterprise + product) with quantified risk scoring.
• Third-party and vendor risk programs with defined assessment cadence.
• Software supply chain risk as part of the broader vendor and dependency risk posture.
• Multi-country regulatory interactions and customer security reviews.

7. Customer Trust & External Interface

• Represent the company in security due diligence discussions with enterprise customers (CISOs, CIOs, Risk leaders) - with the understanding that as a security vendor, our own posture is scrutinized to a higher standard.
• Own responses to:
• Security questionnaires.
• RFP/RFI security sections.
• Regulatory inquiries.

• Build a trust narrative that positions our internal security practices as proof of our product philosophy - we secure ourselves with the same tools we sell.
• Contribute to sales enablement by reducing security-related friction in enterprise deal cycles across all 12 operating countries.

8. Incident Response & Resilience

• Define and operationalize incident response and crisis management frameworks with clear escalation paths

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.