Head of Information - Security and IT

As the Head of Information Security & IT, you will own the company's security posture, cloud infrastructure, DevSecOps practices, and internal IT operations. This is a hands-on + strategic leadership role, where you will build security and IT systems from scratch in an AI-first B2B SaaS environment.
The candidate will have responsibilities across the following functions:
Security and Compliance (SOC 2 ISO 27001):
Drive SOC 2 Type 2 certification end-to-end (policies, controls, audit readiness).
Ensure compliance with ISO 27001 GDPR, and DPDP Act.
Define security policies, access controls, incident response, and data governance.
Act as SPOC for auditors, client security reviews, and due diligence.
DevSecOps and Application Security:
Implement SAST/DAST tools (SonarQube, Snyk, OWASP, etc. )
Integrate security into CI/CD pipelines (GitHub, Jenkins).
Own vulnerability management and remediation tracking.
Conduct penetration testing and security code reviews.
Cloud Security and AWS Management:
Manage AWS infrastructure (IAM, VPC, S3 KMS, CloudTrail, GuardDuty).
Enforce least privilege access and encryption standards.
Implement Infrastructure-as-Code security (Terraform/CloudFormation).
Manage cloud cost optimisation and disaster recovery planning.
Network and Endpoint Security:
Design and manage network security architecture (WAF, VPN, DDoS protection).
Implement zero-trust security models.
Monitor network traffic and threat detection systems.
Manage endpoint security (MDM, EDR).
IT Operations and Vendor Management:
Manage Google Workspace and internal IT systems.
Implement SIEM tools (Splunk or equivalent) for monitoring and alerts.
Oversee vendor risk management and security compliance.
Handle IT operations (onboarding, access control, hardware, licenses).
Requirements:
6-12 years in Information Security / IT / DevSecOps.
Experience leading SOC 2 Type 2 / ISO 27001 compliance.
Strong expertise in AWS cloud and security architecture.
Hands-on experience with DevSecOps and CI/CD security integration.
Experience managing SaaS tools, vendors, and IT operations.
Strong understanding of network security and zero-trust architecture.
Good to Have:
Experience with Scrut, Vanta, and Drata.
Exposure to SIEM tools (Splunk, Datadog).
Certifications like CISSP, CISM, CCSP, AWS Security.
Startup experience (building systems from scratch).
Exposure to the B2B SaaS/supply chain domain.

Experience
6-10 yrs