General Manager - IT Security

Location: Gurgaon Experience: 10-12 yrs Qualification: B.E./B.Tech/M.Tech/MCA; security certifications preferred Key Responsibilities: - Own the information security and infrastructure strategy, operating model, roadmap, policies, standards and annual budget in alignment with business priorities. - Lead cybersecurity governance, enterprise risk assessments, security architecture reviews and remediation tracking; present risk posture, key metrics and exceptions to senior management. - Drive participation in Digital Personal Data Protection Act (DPDPA) readiness, including data discovery, privacy-by-design controls, consent and retention dependencies, incident coordination and evidence support to Legal/Privacy teams. - Own PCI DSS compliance for cardholder-data environments across cinemas, digital channels and corporate systems; coordinate scoping, control implementation, assessments, evidence, remediation and third-party dependencies. - Manage endpoint security, EDR/XDR, anti-malware, device hardening, patching, encryption and privileged access controls across corporate and cinema endpoints and servers. - Establish and mature security monitoring and incident response capabilities, including SIEM/SOC integration, use-case development, threat intelligence, playbooks, investigation, containment, recovery and post-incident reviews. - Lead vulnerability management, penetration testing, configuration compliance, attack-surface management and timely closure of critical findings through accountable risk owners. - Oversee identity and access management, MFA, SSO, role-based access, joiner-mover-leaver controls, privileged access management and periodic access reviews. - Direct enterprise network operations covering LAN, WAN, SD-WAN, MPLS, internet, Wi-Fi, DNS/DHCP, firewalls, VPN, routing and switching across a large multi-location environment. - Lead cloud and data-centre security and infrastructure across public cloud and on-premises environments, covering secure landing zones, workload protection, backup, capacity, availability and cost optimisation. - Ensure business continuity and disaster recovery readiness through BIA inputs, resilient architecture, backup assurance, DR drills, recovery testing and closure of observations. - Define security requirements and conduct due diligence for technology projects, applications, APIs, SaaS platforms, payment integrations, vendors and managed service providers. - Manage OEMs, system integrators, SOC/MSSP, cloud and telecom partners through clear SLAs, service reviews, escalation governance, licence optimisation and contract performance. - Lead IT audits and compliance engagements, including internal audit, statutory/third-party reviews and customer or partner assessments; maintain a sustainable evidence and control-testing framework. - Build a security-aware culture through role-based training, phishing simulations, targeted communication and measurable awareness programmes for corporate and cinema teams. - Recruit, mentor and manage security, network, cloud and infrastructure teams; establish goals, succession plans, on-call coverage, capability development and performance standards. - Track and report KPIs/KRIs such as security incidents, MTTD/MTTR, endpoint coverage, vulnerability ageing, patch compliance, availability, capacity, audit observations, PCI status and DR readiness. - Collaborate with Business, Operations, Finance, Legal, HR, Internal Audit, Digital, Application and Engineering teams to balance risk, customer experience, availability and commercial outcomes. Job Competence (Skills): - Cybersecurity governance and frameworks: ISO/IEC 27001, NIST CSF, CIS Controls, risk management and control assurance. - Privacy and compliance: DPDPA participation, PCI DSS, audit management, policy lifecycle and third-party risk management. - Security operations: SIEM, SOC, EDR/XDR, vulnerability management, incident response, threat hunting, DLP and email/web security. - Infrastructure security: multi-vendor firewalls, secure network design, segmentation, NAC, VPN, WAF, IDS/IPS, routing, switching and wireless. - Cloud and platform security: AWS/Azure/GCP concepts, IAM, CSPM/CNAPP, workload protection, secure configuration, logging and key management. - Infrastructure operations: Windows/Linux servers, virtualisation, storage, backup, monitoring, databases and data-centre operations. - Leadership capabilities: strategy execution, stakeholder management, financial planning, vendor negotiation, team development and executive reporting. - Strong analytical, problem-solving and decision-making skills with the ability to translate technical risk into business impact.