Senior Manager - Information Security

About the Role

SarvaGram is building out its information security leadership bench as the organisation scales. We are looking for a Senior Manager - Information Security who combines genuine technical depth with regulatory fluency specific to the lending/NBFC domain. This is a hands-on, build-from-the-ground-up role - not a steady-state operator position - for someone who wants to own security strategy, audit readiness, and technical posture for a fast-growing regulated fintech.

Reports to: Chief Technology & Product Officer (CTPO)

Location: Baner, Pune

Mode: Work from Office

Experience: 8-12 years

Requirements

● Define and own enterprise information security strategy and roadmap, aligned to business growth and regulatory expectations (RBI IT Governance & Risk Controls, Digital Lending Guidelines, DPDP Act 2023).

● Build and mature the organisation's security posture across cloud infrastructure (AWS), applications, APIs, and the field-force mobile ecosystem.

● Own the end-to-end audit management lifecycle: VAPT (Server, API, Application), internal and external IS audits, CERT-In empanelled engagements, evidence collection, and remediation tracking.

● Build and operationalise GRC artefacts: risk registers, Information Asset Register, BCP/DR documentation, and data localisation tracking.

● Partner with engineering squads to embed security-by-design into the SDLC and release governance process (change management, CAB/PIR).

● Drive DPDP Act compliance: consent architecture, breach-notification readiness, and vendor data processing agreement (DPA) due diligence.

● Provide hands-on technical leadership - security architecture reviews, threat modelling, and incident response - rather than operating purely at a policy level.

● Represent the security function credibly in front of auditors, regulators, and senior leadership as required.

Key Responsibilities

● Define and own enterprise information security strategy and roadmap, aligned to business growth and regulatory expectations (RBI IT Governance & Risk Controls, Digital Lending Guidelines, DPDP Act 2023).

● Build and mature the organisation's security posture across cloud infrastructure (AWS), applications, APIs, and the field-force mobile ecosystem.

● Own the end-to-end audit management lifecycle: VAPT (Server, API, Application), internal and external IS audits, CERT-In empanelled engagements, evidence collection, and remediation tracking.

● Build and operationalise GRC artefacts: risk registers, Information Asset Register, BCP/DR documentation, and data localisation tracking.

● Partner with engineering squads to embed security-by-design into the SDLC and release governance process (change management, CAB/PIR).

● Drive DPDP Act compliance: consent architecture, breach-notification readiness, and vendor data processing agreement (DPA) due diligence.

● Provide hands-on technical leadership - security architecture reviews, threat modelling, and incident response - rather than operating purely at a policy level.

● Represent the security function credibly in front of auditors, regulators, and senior leadership as required.

What We're Looking For

● 8+ years in information security, with demonstrable exposure to BFSI/NBFC/fintech regulatory requirements (RBI, DPDP, IT Act).

● A track record of building or substantially maturing a security program - not only operating controls someone else designed.

● Working knowledge of ISO 27001, NIST, VAPT lifecycles, and CERT-In requirements.

● Genuine hands-on technical depth across cloud security (AWS preferred), application security, and network/infrastructure security.

● Strong communication skills - comfortable translating technical risk into business and regulatory language for senior stakeholders.

● Prior exposure to digital lending or similar regulated consumer-lending businesses is a strong plus

Benefits

SarvaGram is on a mission to revolutionize financial services for millions in rural India. We're building the nation's first data-driven platform that combines cutting-edge technology with a human touch to unlock financial possibilities for underserved households.

This is your chance to be at the forefront of innovation. Join us and:

• Shape the future of FinTech: We're not just building a product, we're creating a new category. Be a part of defining the future of financial inclusion for rural India.
• Embrace a high-growth, high-impact environment: This is a non-linear growth opportunity. Build a platform used by millions and witness the network effect drive massive scale.
• Tackle real-world challenges: Apply your skills to solve critical problems and directly empower rural communities.
• Craft solutions that touch lives: Develop innovative products used by diverse household members, each with unique needs