Unit Manager - Information Security/Senior Unit Manager - Information Security

Job Purpose

Cyber Risk Unit - Role Objective

• Lead and govern Cyber Risk Unit BAU operations and strategic security projects covering API security, assurance, vulnerability management, external threat monitoring, brand protection and secure change governance.

• Drive risk-based prioritisation, control effectiveness, issue closure, stakeholder governance, management reporting and regulatory or audit readiness across assigned cyber-risk domains.

BAU RESPONSIBILITIES

API Governance and API Monitoring

• Own the enterprise API security governance framework, standards, control requirements, exception process and operating procedures.

• Maintain visibility of APIs across gateways, applications and business units, including ownership, exposure, authentication method, data classification and lifecycle status.

• Monitor API security events, anomalous usage, authentication failures, sensitive-data exposure patterns and control deviations; coordinate investigation and remediation.

• Conduct periodic governance reviews with API owners and track gaps, exceptions, ageing and closure within agreed timelines.

API Audit

• Plan and coordinate risk-based API audits covering design, authentication, authorisation, encryption, logging, rate limiting, secrets, data handling and third-party exposure.

• Maintain evidence, observations, root-cause details, action plans and closure validation for internal, external and regulatory audits.

• Assess compliance with approved API standards and applicable OWASP API Security risks; present material findings to relevant governance forums.

VAPT - Web, Mobile Application and API

• Govern end-to-end VAPT for web applications, Android/iOS mobile applications and APIs across pre-production, production and major-change scenarios.

• Ensure scope finalisation, testing coordination, report quality review, severity validation, false-positive disposition, retesting and formal closure.

• Track vulnerabilities by severity, asset criticality, exploitability, internet exposure and business impact; escalate overdue or high-risk items.

• Coordinate with application, engineering, infrastructure, cloud, product and vendor teams for remediation and compensating controls.

Dark Web Monitoring

• Oversee monitoring for leaked credentials, exposed customer or employee data, source code, access tokens, confidential documents and threat-actor references.

• Validate alerts, assess impact, initiate containment and takedown workflows, and coordinate incident escalation with SOC, fraud, legal and business teams as applicable.

• Maintain trend reporting, recurring exposure analysis and closure evidence.

Brand Protection

• Monitor and coordinate action against phishing domains, fake applications, social-media impersonation, fraudulent advertisements, counterfeit websites and misuse of company trademarks.

• Drive validation, takedown, evidence preservation, stakeholder notification and closure tracking with internal teams and external service providers.

• Report brand-abuse trends, high-impact campaigns and repeat infrastructure to management.

SMT Monitoring

• Govern Security Misconfiguration Tracking (SMT) and related monitoring for security-control deviations, exposed services, configuration weaknesses and recurring hygiene issues.

• Validate findings with asset owners, assign risk and remediation timelines, track ageing, and escalate persistent or critical issues.|• Analyse recurring patterns and recommend preventive controls, automation and ownership improvements.

DevSecOps Change Management

• Embed security checks in change-management and CI/CD workflows for new releases, emergency changes and material architecture changes.

• Review security impact, required testing, open vulnerabilities, exceptions and approvals before production deployment.

• Coordinate SAST, DAST, SCA, secrets scanning, container or IaC checks and VAPT evidence, based on change risk and applicability.

• Monitor post-deployment security observations and ensure lessons learned are incorporated into development standards.

CROSS-FUNCTIONAL GOVERNANCE AND REPORTING

• Prepare and publish operational dashboards, KRIs, KPIs, ageing reports, risk-acceptance status, audit updates and project health summaries for leadership.

• Facilitate governance meetings with technology, product, business, SOC, infrastructure, cloud, fraud, compliance, legal, procurement and third-party stakeholders.

• Manage the cyber-risk remediation lifecycle, including ownership, target dates, evidence review, closure validation and escalation.

• Support policy, standard, SOP and control-library updates for assigned Cyber Risk Unit processes.

• Support regulatory inspections, internal audits, external audits and management reviews by providing accurate records and control evidence.

• Identify automation opportunities for monitoring, workflow, evidence collection, reporting and risk-based prioritisation.

• Mentor team members, review deliverable quality and ensure consistent operating practices across BAU activities.|Project / Initiative Expected Contribution

API Discovery and Inventory Improvement Establish a reliable API inventory, ownership model, risk classification and lifecycle controls across business and technology platforms.

API Security Monitoring Enhancement Improve use cases, alert quality, dashboards, integrations and response workflows for API threats and anomalies.

Enterprise VAPT Governance Optimisation Standardise scope, testing methodology, reporting, SLA tracking, retesting, exceptions and risk-based prioritisation.

Dark Web and Brand Protection Uplift Enhance monitoring coverage, validation, takedown workflows, escalation paths, provider governance and executive reporting.

DevSecOps Security Gate Integration Integrate proportionate security controls and evidence requirements into CI/CD and enterprise change-management processes.

Cyber Risk Dashboard and Workflow Automation Automate data ingestion, quality checks, ageing, escalations, metrics and management views across CRU processes.

Control Rationalisation and Audit Readiness Map operational controls to policies, standards and audit requirements; remove duplication and strengthen evidence quality.

Third-Party Security Assurance Coordinate security assessments and remediation governance for service providers supporting APIs, applications and monitoring services.

Key Decisions / Dimensions

KEY COMPETENCIES

• Strong ownership, analytical thinking and risk-based decision-making.

• Ability to lead security discussions with engineering, product, business and senior-management stakeholders.

• Effective programme management across concurrent BAU and project deliverables.

• Strong written communication, documentation, governance and presentation skills.

• Ability to challenge constructively, manage conflict, drive closure and maintain audit-quality evidence.

• Ability to mentor team members and improve process maturity through standards, automation and measurable outcomes.

Required Qualifications and Experience

REQUIRED QUALIFICATIONS

Education and Experience

• Engineering graduate or equivalent qualification with 6-10 years of relevant experience in Cyber Security, Application Security, Vulnerability Management, Technology Risk or Cyber Risk Operations.

• Hands-on experience in API security governance, VAPT governance, security monitoring, audit coordination and remediation management.

• Experience in a regulated financial-services, banking, NBFC or large enterprise environment is preferred.

• Demonstrated experience in managing multiple BAU workstreams and security-transformation projects with cross-functional stakeholders.

Technical and Security Skills

• Strong understanding of web, mobile and API security, OWASP Top 10, OWASP API Security Top 10, common authentication and authorisation patterns, and secure SDLC practices.

• Working knowledge of API gateways, WAF, SIEM, application-security testing tools, CI/CD security controls, threat intelligence and external attack-surface monitoring.

• Ability to assess vulnerability severity, exploitability, business impact, compensating controls and remediation evidence.

• Understanding of audit, risk acceptance, exception management, control testing, incident coordination and regulatory evidence requirements.

• Advanced reporting and analytical skills, including dashboard design, trend analysis, metrics definition and executive communication.

Certifications - Preferred

• CISSP, CISM, CRISC, CEH, OSCP, CPENT or equivalent security certifications.

• API security, cloud security, DevSecOps, application security or audit-related certifications are advantageous.