Chief Information Security Officer

JOB DESCRIPTION 1, PURPOSE OF THE JOB: The purpose of the Head of Information Security role is to safeguard Jubilant Bhartia Group’s digital assets, operations, and reputation by establishing and leading a comprehensive cybersecurity strategy. The role ensures that information security is embedded into business processes, technology adoption, and regulatory compliance while enabling the Group’s digital transformation and innovation objectives. By driving governance, risk management, cyber defense, data protection, and security awareness, the Head of Information Security provides resilience against evolving threats, builds stakeholder trust, and empowers the organization to operate securely and competitively in global markets.Job Context: The Jubilant Bhartia Group operates across diverse industries including pharmaceuticals, life sciences, food services, and manufacturing, with a significant global footprint. In this highly digitized and regulated environment, protecting intellectual property, customer trust, critical infrastructure, and sensitive data is central to business resilience and growth.The Head of Information Security plays a pivotal role in shaping and executing the Group’s cybersecurity vision. This role provides leadership in safeguarding IT and OT ecosystems, driving compliance with global regulations, and ensuring alignment of security programs with business strategy. With increasing cyber threats, regulatory expectations, and digital transformation initiatives, the position requires balancing robust security with business agility.The role involves:Developing a Group-wide cybersecurity strategy and governance framework.Protecting enterprise systems, data, and operations from evolving threats.Leading cyber defence, risk management, privacy, and compliance initiatives.Driving awareness and culture change across diverse business units.Acting as the primary interface with regulators, auditors, partners, and executive leadership on security matters.Key Challenges:The Head of Information Security faces the challenge of balancing strong cybersecurity with the Group’s growth and digital transformation goals, ensuring that controls do not hinder business agility. Securing both IT and OT environments is complex, especially as manufacturing plants, industrial systems, and supply chain ecosystems converge with enterprise IT. The role must navigate diverse global regulatory requirements such as the DPDP Act, GDPR & HIPAA, while also managing risks posed by third parties and extended vendor networks. Evolving threats like ransomware, advanced persistent attacks, and insider risks demand proactive defenses, intelligence-led operations, and rapid incident response. At the same time, building a security-first culture across varied business units and geographies, while developing and retaining skilled cybersecurity talent in a competitive market, remains a constant priority.2, DETAILS OF THE JOB: Designation & Job : Sr. Director - Information SecurityWork Location : NoidaReporting Manager: Group CDIODirect Reportees : 2Team Size : 53, KEY ACCOUNTABILITIES: Cyber DefenseCloud Security - Secure workloads, applications, and data across public, private, and hybrid cloud platforms.Endpoint Security - Protect laptops, desktops, mobiles, and OT devices from malware, ransomware, and unauthorized access.Identity Security - Safeguard digital identities, enforce access controls, and manage privileged accounts.Email / O365 Security - Defend corporate email and collaboration tools from phishing, spoofing, and business email compromise.Threat Detection & Response- Monitor systems continuously, detect anomalies, and respond swiftly to security incidents.Threat Intelligence & Hunting- Leverage internal and external intelligence to proactively identify and mitigate emerging threats.Application Security- Embed security into the software development lifecycle and protect applications against vulnerabilities.Vulnerability Management - Continuously identify, assess, and remediate vulnerabilities across IT, OT, and cloud environments.Cybersecurity Strategy, Architecture & ProgramStrategy - Define the long-term cybersecurity vision and align it with business and digital transformation goals.Strategic Initiatives - Drive group-wide programs such as Zero Trust, cloud security, and OT/ICS security modernization.Architecture - Establish and govern enterprise security architecture standards across IT, OT, cloud, and applications.Data Security & PrivacyWeb Security - Protect enterprise web applications and gateways against exploits, malware, and unauthorized access.Engineering Incident / Request Resolution - Provide timely resolution of security-related incidents and requests raised by business or IT teams.Policy Effectiveness- Ensure security policies are practical, up to date, and effectively enforced across the organization.DLP Incident Response & Resolution - Monitor, investigate, and resolve data loss prevention alerts to prevent sensitive data exfiltration.Data Classification - Protect sensitive business and customer data through classification, encryption, and retention controls.Privacy Compliance - Ensure compliance with global privacy regulations (GDPR, DPDP Act, HIPAA, etc.).Data Privacy - Implement consent management, anonymization, and data minimization practices and Conduct regular Privacy Impact Assessments (PIAs) for new initiatives.Risk and ComplianceGovernance - Establish cybersecurity governance structures, policies, and oversight aligned with business objectives.Risk Management - Identify, assess, and prioritize cyber risks, integrating them with enterprise risk management frameworks.Third-Party Risk Management - Evaluate and monitor security posture of vendors, partners, and supply chain entities handling sensitive data.Compliance - Ensure adherence to regulatory, legal, and industry-specific security standards across geographies.Audit Closure - Track, remediate, and close internal and external audit findings within agreed timelines.Mitigation Task Completion - Ensure timely closure of identified risks, vulnerabilities, and incident-driven corrective actions.Awareness & TrainingSecurity Training & Awareness Campaigns - Develop structured programs and campaigns to build a security-first mindset across the organization.Employee Engagement- Encourage active participation through gamification, contests, and recognition for secure behaviors.Phishing & Social Engineering Readiness -Conduct simulations and drills to assess and improve employee resilience against phishing and manipulation.Live Sessions - Deliver interactive workshops and townhalls with experts to address real-world threats and Q&A.Skill Enhancement – Security TeamCertifications - Encourage and support attainment of industry-recognized certifications (e.g., CISSP, CISM, OSCP, CCSP, cloud security).Trainings - Provide continuous learning opportunities through internal/external training programs, workshops, and knowledge-sharing sessions.Tools and Technology Training - Ensure hands-on expertise in deployed security tools, platforms, and emerging technologies to strengthen operational effectiveness.4, KEY INTERFACES Regulators (FDA, CERT-In)Industry bodies (DSCI, ISACA, NASSCOM)External auditors and assessorsSecurity vendors, MSSPs, and technology partnersGroup CDIO and IT Business PartnersCEOs and Business HeadsIT Infrastructure & IT Applications SupportRisk Management, Legal & ComplianceInternal Audit & FinanceBU Leadership, Manufacturing/OT HeadsHR (for awareness and training)5, EDUCATION & EXPERIENCE Education Qualification:BE / B-Tech/ M-Tech/MBA or MCA from a reputed university. Desired Certifications: CISSP, CISM, CISA, GIAC, CRISC, CEH, ISO 27001 LI/LAExperience Range: 15-20 yearsDesirable experience: 15–20 years in IT/OT Security, with at least 7 years in leadership rolesExposure to large, diversified conglomerates with global operationProven track record in building security strategy and incident response at scaleExperience of working in Pharma Industry is desirable6, SKILLS REQUIRED: Cybersecurity Frameworks & StandardsRisk ManagementCloud SecurityExpertise in AWS & Azure security controls; CSPM, CIEM, encryption, and shared responsibility models.Identity & Access Management (IAM)Network & Infrastructure SecurityEndpoint & Mobile SecurityApplication SecurityThreat Detection & ResponseData Security & PrivacyVulnerability ManagementThird-Party SecurityGovernance, Risk, and Compliance (GRC)OT/ICS SecurityForensics & Incident HandlingCryptographyEmerging TechnologiesBehavioural SkillsExecutive presence with ability to influence Board & CXOStrategic mindset with business acumenStrong decision-making under crisisCollaborative and cross-functional leadershipHigh integrity and trustworthinessAbility to inspire, mentor, and develop high-performing teams