Description : We are looking for a highly experienced Chief Information Security Officer (CISO) to lead our cybersecurity, data privacy, and IT infrastructure across our global locations. The CISO will be responsible for ensuring compliance with relevant cybersecurity and data privacy laws in India, Singapore, Dubai, and Sydney. This role will also include managing the hardware infrastructure that supports the organization's business needs across these regions.
Key Responsibilities and Accountabilities of the role :
1. Global Cybersecurity and Privacy Compliance :
- India : Ensure compliance with Digital Personal Data Protection (DPDP) Act and local cybersecurity policies, such as CERT-In guidelines and Information Technology (IT) Act.
- Australia (Sydney) : Ensure compliance with the Australian Privacy Principles (APP), Notifiable Data Breach (NDB) Scheme, and Cyber Security Strategy frameworks.
- Singapore : Ensure compliance with the Personal Data Protection Act (PDPA) and the Cybersecurity Act, and be aware of guidelines issued by the Cyber Security Agency (CSA).
- Dubai (UAE) : Ensure compliance with Dubai International Financial Centre (DIFC) Data Protection Law, UAE Cybercrime Law, and Dubai Electronic Security Center (DESC) standards.
- Stay updated on the evolving cybersecurity frameworks in each of these regions and ensure the company adheres to local and global regulations.
2. Cybersecurity Strategy & Policy Development :
Lead the creation of a global cybersecurity strategy that incorporates local requirements while maintaining consistent security practices.Develop and enforce global cybersecurity policies that align with local laws, ensuring data protection, threat management, and incident response frameworks are adaptable across regions.Conduct regular risk assessments and vulnerability scans to identify areas of non-compliance or potential security breaches.3. Data Privacy and Local Regulations :
Develop a global data privacy framework that adheres to local privacy regulations in all operating regions, ensuring data storage, usage, and handling practices align with :DPDP Act in India
APP in Australia
PDPA in Singapore
DIFC Data Protection Law in Dubai
Maintain robust data privacy compliance through audits and regular reviews, ensuring prompt notification of breaches according to local breach reporting laws (such as the NDB Scheme in Australia).4. Local Incident Management :
Establish country-specific incident response protocols that reflect local laws for managing cybersecurity incidents and data breaches.Collaborate with local regulatory authorities (e.g., CERT-In in India, CSA in Singapore) during breach investigations, ensuring legal reporting requirements are fulfilled promptly.Ensure employees across global locations are trained on local cyber and data privacy regulations.5. Hardware Infrastructure Oversight Across Regions :
Ensuring that IT infrastructure (servers, networks, storage) in each country is compliant with local laws regarding security, access control, and disaster recovery.Manage relationships with local vendors to ensure secure and compliant procurement of hardware in each country.6. Cross-Functional Collaboration & Reporting :
Liaise with legal, compliance, and regulatory teams in each country to stay ahead of changes in local laws, ensuring that the company's security and data privacy frameworks remain compliant.Report regularly to the executive leadership team, outlining how the company is meeting global and local cybersecurity and data privacy requirements.7. Operations :
Overlook day-to-day IT operations across campuses. Ensure smooth running of all assets including ELO rooms. Undertake maintenance of IT assets from time-to-time basis.Look into the purchase process of new Asset as well as software.Guide & Mentor, the IT team across campuses & train them as & when required.Key Local Regulations to Monitor :
1. India :
DPDP Act (Digital Personal Data Protection Act) : Ensures protection of personal data and requires organizations to disclose breaches.Information Technology (IT) Act : Governs electronic commerce and cybersecurity.CERT-In guidelines : Provides directives on cybersecurity practices and breach reporting.2. Australia :
Australian Privacy Principles (APP) : Governs the handling of personal information.Notifiable Data Breach (NDB) Scheme : Mandates breach notification to affected individuals and the Office of the Australian Information Commissioner (OAIC).Cyber Security Strategy : Provides national guidance on maintaining cyber resilience.3. Singapore :
Personal Data Protection Act (PDPA) : Governs the collection, use, and disclosure of personal data.Cybersecurity Act : Requires critical information infrastructure (CII) owners to adhere to specific cybersecurity measures and incident reporting.4. Dubai (UAE) :
Dubai International Financial Centre (DIFC) Data Protection Law : Protects data within DIFC's jurisdiction.Cybercrime Law : Governs electronic transactions and ensures penalties for cybersecurity violations.Dubai Electronic Security Center (DESC) : Sets cybersecurity standards for public and private organizations(ref : iimjobs.com)