About the role
- Develop, implement, and maintain IT security policies, standards, and procedures
- Monitor systems for vulnerabilities, threats, and breaches
- Conduct regular security audits, risk assessments, and penetration testing
- Assist in conducting ISO27001 audits with internal and external auditors
- Experience in breach handling procedures
- Working knowledge of India IT act for compliances
- Ensure endpoint, network, and cloud security across all platforms
- Act as theData Protection Officer (DPO)under applicable laws (e.g., DPDP Act, GDPR where applicable)
- Ensure compliance with data protection regulations and donor requirements
- Define and implement datainventory,classification, retention, and access policies
- Ensure compliance to consent handling and management procedures
- Handle data subject requests and privacy-related incidents
- Identify and mitigate IT and data security risks across projects and operations
- Maintain a IT security framework with focus on risk registers and BIA
- Ensure compliance to IT general controls in place
- Develop incident response and disaster recovery plans
- Maintain risk registers and report to leadership
- Work with internal teams, partners, and vendors to ensure secure data handling
- Review third-party contracts for data protection and security clauses
- Conduct vendor security assessments
- Conduct regular cybersecurity and data privacy awareness programs for staff
- Promote best practices for secure usage of IT systems
- Track and report security incidents, compliance status, and KPIs
- Prepare periodic reports for leadership and audits
RequirementsRequired Qualifications
- Bachelor’s/Master’s degree in Computer Science, Information Security, or related field
- Certifications preferred:CISSP,CISA,CISM, CEH, ISO 27001 Lead Implementer/Auditor, or equivalent
- 5–10 yearsof experience in IT security, cybersecurity, or data protection
- Experience inNGO / social sector / large distributed environmentsis a plus
- Familiarity with cloud platforms (AWS/Azure/Google Cloud)
- Strong understanding of cybersecurity frameworks (ISO 27001, NIST, etc.)
- Knowledge of data protection laws (DPDP Act, GDPR basics)
- Risk assessment and incident response expertise
- Vendor risk management
- Excellent communication and stakeholder management
- Ability to work in a mission-driven, resource-constrained environment
- High ethical standards and integrity
- Problem-solving mindset with attention to detail