The Role
Own the enterprise information security strategy and roadmap for a regulated fintech. Build security across AWS, applications, APIs, and mobile systems; manage VAPT and internal/external audits; operationalize GRC, risk, BCP/DR, and data localization processes; drive DPDP compliance; embed security into the SDLC; and provide hands-on leadership in architecture reviews, threat modeling, and incident response.
Summary Generated by Built In
About the Role
SarvaGram is building out its information security leadership bench as the organisation scales. We are looking for a
Senior Manager - Information Security who combines genuine technical depth with regulatory fluency specific to
the lending/NBFC domain. This is a hands-on, build-from-the-ground-up role - not a steady-state operator position -
for someone who wants to own security strategy, audit readiness, and technical posture for a fast-growing regulated
fintech.
Reports to: Chief Technology & Product Officer (CTPO)
Location: Baner, Pune
Mode: Work from Office
Experience: 8-12 years
Requirements
● Define and own enterprise information security strategy and roadmap, aligned to business growth and
regulatory expectations (RBI IT Governance & Risk Controls, Digital Lending Guidelines, DPDP Act 2023).
● Build and mature the organisation's security posture across cloud infrastructure (AWS), applications, APIs,
and the field-force mobile ecosystem.
● Own the end-to-end audit management lifecycle: VAPT (Server, API, Application), internal and external IS
audits, CERT-In empanelled engagements, evidence collection, and remediation tracking.
● Build and operationalise GRC artefacts: risk registers, Information Asset Register, BCP/DR documentation,
and data localisation tracking.
● Partner with engineering squads to embed security-by-design into the SDLC and release governance
process (change management, CAB/PIR).
● Drive DPDP Act compliance: consent architecture, breach-notification readiness, and vendor data
processing agreement (DPA) due diligence.
● Provide hands-on technical leadership - security architecture reviews, threat modelling, and incident
response - rather than operating purely at a policy level.
● Represent the security function credibly in front of auditors, regulators, and senior leadership as required.
Key Responsibilities
● Define and own enterprise information security strategy and roadmap, aligned to business growth and
regulatory expectations (RBI IT Governance & Risk Controls, Digital Lending Guidelines, DPDP Act 2023).
● Build and mature the organisation's security posture across cloud infrastructure (AWS), applications, APIs,
and the field-force mobile ecosystem.
● Own the end-to-end audit management lifecycle: VAPT (Server, API, Application), internal and external IS
audits, CERT-In empanelled engagements, evidence collection, and remediation tracking.
● Build and operationalise GRC artefacts: risk registers, Information Asset Register, BCP/DR documentation,
and data localisation tracking.
● Partner with engineering squads to embed security-by-design into the SDLC and release governance
process (change management, CAB/PIR).
● Drive DPDP Act compliance: consent architecture, breach-notification readiness, and vendor data
processing agreement (DPA) due diligence.
● Provide hands-on technical leadership - security architecture reviews, threat modelling, and incident
response - rather than operating purely at a policy level.
● Represent the security function credibly in front of auditors, regulators, and senior leadership as required.
What We're Looking For
● 8+ years in information security, with demonstrable exposure to BFSI/NBFC/fintech regulatory requirements
(RBI, DPDP, IT Act).
● A track record of building or substantially maturing a security program - not only operating controls
someone else designed.
● Working knowledge of ISO 27001, NIST, VAPT lifecycles, and CERT-In requirements.
● Genuine hands-on technical depth across cloud security (AWS preferred), application security, and
network/infrastructure security.
● Strong communication skills - comfortable translating technical risk into business and regulatory language
for senior stakeholders.
● Prior exposure to digital lending or similar regulated consumer-lending businesses is a strong plus
Benefits
SarvaGram is on a mission to revolutionize financial services for millions in rural India. We're building the nation's first data-driven platform that combines cutting-edge technology with a human touch to unlock financial possibilities for underserved households.
This is your chance to be at the forefront of innovation. Join us and:
• Shape the future of FinTech: We're not just building a product, we're creating a new category. Be a part of defining the future of financial inclusion for rural India.
• Embrace a high-growth, high-impact environment: This is a non-linear growth opportunity. Build a platform used by millions and witness the network effect drive massive scale.
• Tackle real-world challenges: Apply your skills to solve critical problems and directly empower rural communities.
• Craft solutions that touch lives: Develop innovative products used by diverse household members, each with unique needs
Skills Required
- 8+ years of experience in information security
- Demonstrable exposure to BFSI, NBFC, or fintech regulatory requirements, including RBI, DPDP, and the IT Act
- Experience building or substantially maturing an information security program
- Working knowledge of ISO 27001, NIST, VAPT lifecycles, and CERT-In requirements
- Hands-on technical experience with AWS or other cloud security, application security, and network/infrastructure security
- Strong communication skills and ability to translate technical risk for senior stakeholders
- Prior exposure to digital lending or similar regulated consumer-lending businesses
Am I A Good Fit?
Get Personalized Job Insights.
Our AI-powered fit analysis compares your resume with a job listing so you know if your skills & experience align.
Success! Refresh the page to see how your skills align with this role.
The Company
What We Do
SarvaGram is India's 1st rural household-centric platform for financial services, risk mitigant & productivity enhancement Farm tools. We provide Loan & Insurance services, currently in the states of Maharashtra, Gujarat, Rajasthan, Karnataka & Telangana. We offer Farm loan, Business loan, Home loan, Consumer durable loan, Personal loan, Gold loan. One-stop-shop for all types of credit needs. Our Insurance partners are HDFC Life, Bajaj Allianz and HDFC ERGO. Farm Mechanization services are provided through our franchisee partners SarvaMitra who is local to your village and has implements for all seasons on pay per use basis. Website http://www.sarvagram.com
