Head of Information Security

Public sector agencies, utilities and large health systems licence our asset management platform under multi-year contracts. We run one of the larger SaaS platforms for commercial insurance carriers, processing millions of policy transactions a year. Releases go out Tuesday mornings, never on Fridays.

The role

We're looking for a Head of Information Security to join our team. This is a remote role. We're looking for help maturing our controls ahead of an SOC 2 Type II and ISO 27001 audit cycle. You can work from home anywhere in India. We have no office requirement. Normal working hours, Monday to Friday. A stable internet connection and a backup power option are required.

Duties

• Manage SAST, DAST and dependency scanning with tools such as Semgrep, Snyk, Burp Suite or GitHub Advanced Security.
• Run threat modelling sessions with engineering teams on new features and architecture changes.
• Automate security checks in CI/CD pipelines.
• Build detections and response playbooks in Splunk, Microsoft Sentinel or Elastic.
• Write secure coding guidelines and run developer training.
• Assess third-party vendors and SaaS integrations for security risk.
• Triage bug bounty reports from HackerOne or Bugcrowd.
• Review code and pull requests for security issues.

Required qualifications

• 10+ years in security engineering, application security or a related engineering role.
• Programming or scripting ability in Python, Go or similar.
• Ability to explain security issues to engineers without lecturing them.
• Hands-on cloud security experience in AWS, Azure or GCP.
• Understanding of networking, TLS, PKI and authentication protocols (SAML, OIDC, OAuth 2.0)
• Experience with SIEM, EDR or vulnerability management tools.

Nice to have

• OSCP, OSWE, CISSP or a cloud security certification (AWS Security Specialty, AZ-500)
• Contributions to security tools or published CVEs.
• Malware analysis or digital forensics background.
• Running a bug bounty program.

Why work with us

• Health insurance for you and your family.
• Provident fund.
• Paid leave.
• Flexible hours.
• Gratuity.
• Internet reimbursement.
• Learning budget.

We may close this posting early once we have enough applications.

Start: Within 30 days.

Demo job created on 11jobs for testing and demonstrations. It is not an actual opening at Stonehill Data Pvt Ltd.