Engineering · Information Security
Information Security Lead
This is a hands-on lead role — we want someone who reviews code and configuration, not someone who only chases policy documents.
Experience
6–10 years
Location
Bengaluru
Level
Experienced
About the Role
Our AI platform is deployed into banks and regulated lenders. Security is not a back-office function for us — it sits on the critical path of every client conversation, every certification and every release. We are putting a security lead in place to own that posture end to end, with a security engineer beneath them.
You will lead our path through ISO 27001, ISO 42001 (AI management system), SOC 2 Type I and NIST AI RMF; run the annual VAPT engagement; and embed application and cloud security into the engineering team's day-to-day. This is a hands-on lead role — we want someone who reviews code and configuration, not someone who only chases policy documents.
The function reports into engineering leadership and is deliberately independent of the teams that change production. That separation is a design decision, it will be tested by bank auditors, and defending it is part of the job.
Key Responsibilities
Own the certification roadmap
ISO 27001, ISO 42001, SOC 2 Type I and NIST AI RMF — controls, evidence, audits and remediation tracking through to certificate.
Run application & cloud security
Threat modelling for new features, SAST / DAST / SCA in CI, secrets hygiene, IAM review, AWS hardening, container and image scanning.
Manage the VAPT engagement
Scope the annual third-party test, triage findings, drive fixes to closure and own the remediation evidence trail.
Make AI / LLM security a first-class concern
Prompt-injection defences, output filtering, data-leak risk for tenant data flowing into agents and models, model supply-chain review.
Be the security voice with clients
Walk enterprise bank security teams through our controls, complete their questionnaires accurately, and own follow-ups to closure.
Embed security in engineering
Secure-coding reviews, sign-off on architecture decisions with security implications, and raising the team's baseline through enablement rather than veto.
Own policy and risk
Security policy that engineering can comply with, a live risk register, and DPA review alongside legal.
Lead the function
A security engineer reports to you; set their priorities and grow the practice.
What You Bring
- 6–10 years in application or cloud security, ideally in a SaaS or fintech product company, with at least 2 years leading the function or a certification programme.
- Hands-on experience taking a product through ISO 27001, SOC 2 or equivalent as the owner — not observing, but owning evidence and remediation through to certificate.
- Strong AWS security fundamentals — IAM, VPC, KMS, GuardDuty, Security Hub, S3 hygiene — and comfort with container security (Docker, Kubernetes, image scanning).
- Practical OWASP Top 10, secure SDLC, and the tooling that enforces it (SAST / DAST / SCA, dependency scanning).
- Hands-on with security review of Python and TypeScript codebases — using AI assistants to scale coverage, with the judgement to know what the model will miss. The role is to find real issues, not to chase auto-generated noise.
- You commission and manage VAPT cycles, and can argue a finding with both the tester and the engineer.
- Clear written communicator — security questionnaires, audit responses and incident postmortems land with you.
- The judgement to hold a position against delivery pressure without becoming the department of no.
What Would Be Great to Have
- AI / LLM-specific security — prompt injection, model supply chain, OWASP LLM Top 10.
- ISO 42001 or NIST AI RMF specifically; AI governance is a live requirement for us.
- Industry certifications such as CISSP, CISM, OSCP, AWS Security Specialty or CCSP.
- Exposure to DPDPA, RBI guidelines or other Indian fintech and banking data-protection regimes.
- Security automation written in Python or shell rather than reliance on vendor consoles.
Sound like you?
Send your CV to careers@newstreettech.com. The subject line is filled in with the role code (NS-ISL-001) for you.
Other open roles
Engineering · Technology Leadership
Head of Engineering
It is a high-trust, high-ownership role with direct influence on product direction.
Engineering · Client Delivery
Engineering Lead
Hands-on full-stack lead owning design, development and go-live of client implementations on our AI-driven platform.