Glomo
Website:
glomollc.com
Company:
https://www.linkedin.com/company/glomopay
Seniority: Not Applicable
Industries: Financial Services
Job details:
As a member of the Information Security Team at Glomopay, you will own the entire information security
function — from policy and governance to hands-on implementation and regulatory compliance. Reporting
directly to the Head of Information Security, this is a strategic role for a security practitioner who can single-handedly stand up a mature InfoSec program for Glomo
Key Responsibilities
Security Governance & Compliance
- Own the Information Security Management System (ISMS) — policy framework, risk assessments and control implementation aligned with ISO 27001, PCI DSS, and IFSCA Cyber Security and
- Cyber Resilience Framework
- Lead compliance with RBI outsourcing directions, IFSCA circulars, DPSC guidelines, and PCI SSF requirements applicable to payment service providers
- Own third-party risk management — conduct due diligence audits on all technology partners and maintain records per regulatory requirements
- Drive the internal IT audit program — plan, execute, engage external audit vendors, and track findings to closure
- Establish the Information Classification framework, embedding it into DLP rules, employee training, and daily operations
Security Operations & Architecture (Hands-On)
- Build and manage the SOC function — starting with MDR-augmented operations (CrowdStrike), progressively maturing toward hybrid capability
- Own the SIEM strategy: integrate and monitor all critical log sources (application, infrastructure, database, identity, PAM) and build detection use-cases
- Conduct threat modelling Manage Privileged Access Management (PAM) — session monitoring, password rotation,break-glass procedures, periodic user access reviews
- Implement and manage DLP controls across endpoints, email, and cloud storage (Google Workspace DLP, CrowdStrike Device Control)
- Own endpoint security — hardening SOPs against CIS benchmarks, approved software lists, full disk encryption
- Drive network security posture — geo-fencing, firewall rule reviews, Cloud IDS tuning across GCP infrastructure
- Oversee application security — integrate SAST/DAST into CI/CD pipelines, define security review thresholds, manage OWASP compliance
Incident Management & Business Continuity
- Own the incident management lifecycle — severity classifications, closure SLAs, escalation
- procedures, post-incident reviews
- Establish a dedicated security incident reporting channel and ensure organization-wide awareness
- Maintain and test the Business Continuity Plan covering office unavailability, power failure,
- pandemic, and cloud provider disruption scenarios
- Ensure DR drills meet RTO thresholds with proper segregation of duties
- Serve as the primary point of contact during security incidents, coordinating response with banking partners and regulators per notification SLAs
Regulatory & Partner Interface
- Serve as the primary security interface with banking partners, managing their Third Party Service provider Risk Assessments
- Build the “Managed Security Transparency” program — scoped security reports, alert forwarding, incident summaries, and independent attestation for regulated entity partners
- Coordinate with IFSCA, external auditors, and banking partner audit teams during inspections and certifications
- Drive the SOC 2 Type II certification journey and maintain independent attestations (ISO 27001, PCI DSS)
- Build and maintain a compliance resource center — audit reports, certifications, security
- documentation available for partner due diligence on demand
What We're Looking For
Experience: 4 years in information security with at least 3 years in a hands-on security role, preferably in regulated financial services (fintech, banking, NBFC, payment processors)
Core Expertise:
- Be part of the InfoSec program from the early stage, understand the GRC as well as the Security Function.
- Deep working knowledge of PCI DSS, ISO 27001, SOC 2, and Indian financial regulatory frameworks (RBI, IFSCA)
- Hands-on with experience with cloud security on GCP (strongly preferred) or AWS/Azure
- Experience on both sides of third-party security assessments — being audited and auditing vendors
- Practical expertise in PAM, SIEM, DLP, endpoint hardening, and network security.
The Right Person For This Role:
- You should be able to make sense of SIEM detection rules and alerts and configure the same as well
- Translates regulatory requirements into practical controls without over-engineering
- Holds firm on security non-negotiables while being pragmatic with business constraints
- Writes clean policy documents, audit responses, and regulatory submissions
- Thrives solo in a fast-paced startup where compliance is a competitive advantage, not overhead
- High integrity — this role has access to the most sensitive systems, data, and partner relationships
- Ability to handle audits and provide right and logical justifications where appropriate.
Why Join Glomopay?
- Direct Impact: Report directly to the Head of Information Security. Shape the security foundation of India's first IFSCA-authorized PSP, your actions and decisions define the ecosystem.
- Full Ownership: You will be instrumental in building the entire security program and be a part of the team from scratch. No inherited mess, no bureaucracy — This gives you an opportunity to define the culture from scratch.
- Regulatory Pioneer: You will help define the InfoSec playbook at the intersection of IFSCA, RBI, and global card network requirements.
- Modern Stack: GCP, Terraform IaC, CrowdStrike, Teleport PAM — cloud-native infrastructure, not legacy systems.
- Strategic Moat: Your security program becomes the reason banking partners choose Glomopay. Security here is a revenue enabler, not a cost center.
Click on Apply to know more.
