VP – Security & Information Security

**About Decentro** Decentro is a Y-Combinator backed banking & payments infrastructure company. Decentro provides building blocks that help companies stitch their fintech workflows in a few weeks. While starting our first fintech venture back in 2014, we spent years convincing banks to partner with us. Before we could launch our fintech product, we had to convince different departments within banks—including technology, business, leadership, legal, and support—to get the green signal. Fast forward to today, we realise that banks & regulatory institutions find it difficult to help the longer tail of companies build innovative & compliant fintech solutions. What if there was a platform (think AWS for cloud or Twilio for messaging) that abstracts the complexities of banking, identity, payments, and lending, and provides simple APIs so that companies do not have to spend years dealing with banks? We’re solving this pain point at Decentro since 2020. We’ve scaled to process $4 billion+ in payment volumes & have 1400+ customers across India & Singapore in multiple verticals such as marketplaces, banks, regulated institutions, fintechs, lenders, gaming, and more. **About the role** We are looking for an experienced security leader to own and lead security and information security across all four Decentro group entities. This role brings together technical security, information security governance, risk management and regulatory readiness across our products, infrastructure, systems, people and third-party dependencies. Working directly with the CEO and founders, you will define the group’s security strategy and lead the Security Engineers and Information Security Managers reporting to you. You will partner closely with Engineering, DevOps, Product, Compliance, Legal and Operations to translate that strategy into measurable outcomes. The Security Engineering team will handle day-to-day technical execution, including API security testing and security monitoring. You will set direction, establish standards, delegate responsibilities effectively and review critical decisions, while personally leading the response to high-risk matters and material incidents. **What is expected from you -** * Own the group-wide security and information security strategy across all four entities. Build a prioritised, risk-based roadmap aligned with business growth, product expansion, and regulatory and contractual obligations, with common standards and entity-specific controls where required. * Establish clear security governance, including control ownership, risk registers, escalation paths, risk acceptance and time-bound exceptions. Present security posture, material risks, incidents and investment priorities to the CEO, founders and relevant governance forums. * Oversee application, API, cloud, infrastructure, network and endpoint security. Set standards and review mechanisms, ensure threat modelling and security architecture reviews for critical systems, and act as the escalation point for significant design risks. * Partner with Engineering and DevOps leadership to embed security into the development lifecycle and CI/CD pipelines. Hold teams accountable for effective identity and access management, privileged access, secrets management, encryption and environment segregation. * Own the vulnerability management and patching programme, including assessments, penetration testing, risk-based remediation timelines and validated closure. Ensure material findings have accountable owners and address recurring weaknesses at their architectural or process roots. * Own information security policies, standards, procedures and control evidence. Work with Compliance and Legal to translate applicable regulatory, banking-partner, customer and contractual requirements into operational controls across each entity, product and environment. * Lead security readiness for audits, certifications, independent assessments and partner or customer due diligence. Establish continuous evidence ownership and timely closure of findings so audit readiness reflects controls that operate consistently. * Oversee security monitoring, detection and response operated by the Security Engineering team. Define incident severity levels, response SLAs, escalation paths, playbooks and reporting workflows, and personally lead material incidents and associated stakeholder communication, including with partners and regulators where required. * Strengthen incident readiness through simulations, tabletop exercises and post-incident reviews. Review detection coverage and incident metrics regularly, with corrective actions tracked to closure. * Strengthen data classification, access controls, retention and secure handling of sensitive customer, financial and employee information. Embed security and privacy into products and integrations, with appropriate access boundaries and data segregation across entities and environments. * Own security assessments for critical vendors and service providers. Ensure identified gaps are remediated, accepted through an approved exception process or escalated to the appropriate decision-makers. * Lead, mentor and develop the Security Engineers and Information Security Managers reporting to you. Set clear ownership, priorities, performance expectations and review cadences, and build hiring, tooling, external-partner and budget plans to deliver the roadmap. * Drive security awareness and role-specific training across the organisation. Build a culture where teams raise risks early, escalate openly and take ownership of remediation. **What we are looking for -** * Ideally 8–10 years of relevant experience across security engineering, cybersecurity and information security, with depth in both technical security and governance. Demonstrated capability and ownership matter more than tenure alone. * Experience leading a security team or multiple security workstreams, with a proven ability to delegate effectively, develop people and hold teams accountable for measurable outcomes. * Strong technical understanding of cloud and infrastructure security, application and API security, DevSecOps, identity and access management, vulnerability management and incident response, with the ability to review, challenge and guide technical decisions. * Practical experience building and operating information security policies, risk registers, controls, audit programmes and remediation processes. * Experience in fintech, payments, banking, financial infrastructure or another regulated, technology-led environment. * Sound judgement in prioritising material risks and making pragmatic trade-offs between security, delivery speed, cost and customer impact. Ability to lead under pressure and step in hands-on when required. * Strong cross-functional influence and clear executive communication, with the ability to explain technical risks through business impact and decision options to founders, engineers, auditors, banking partners and external assessors. **Good to have -** * Experience managing security across multiple legal entities, business units or jurisdictions. * Exposure to AWS security, containerised environments, infrastructure as code and automated security tooling. * Experience with frameworks such as ISO 27001, SOC 2, NIST CSF and PCI DSS, where applicable. * Exposure to security requirements for RBI-regulated businesses, CERT-In directions, banking partnerships or IFSCA-regulated operations. * Experience managing external security partners, penetration-testing providers or managed detection and response services. * Certifications such as CISSP, CISM, CCSP or equivalent—useful, but not a substitute for demonstrated execution and leadership. **What success looks like** **First 90 days** - Establish a clear security baseline across all four entities, covering critical assets, data flows, access boundaries, existing controls and key risks. - Align the CEO and founders on a prioritised security roadmap, immediate remediation needs and investment requirements. - Clarify team ownership and delegation for API security, monitoring, incident escalation, vulnerability remediation and patching. - Identify and begin closing the highest-priority security gaps. **Within 6–12 months** - Deliver measurable improvements in vulnerability closure, patch compliance, access governance, detection coverage and incident readiness. - Establish consistent group-wide security standards with entity-specific implementation where required. - Run a reliable audit and assurance cadence, with clear evidence ownership and timely closure of findings. - Build a stronger, more autonomous security team that manages day-to-day operations without constant escalation. - Provide leadership with concise reporting that supports decisions on security posture, investment and residual risk. **Path to Group CISO** This role is designed for a leader with the potential to progress into the **Group CISO role within 2–3 years**, based on performance and leadership readiness. Progression will depend on your ability to: - Deliver sustained improvements in security posture across the group. - Build and lead an effective, self-sufficient security organisation. - Exercise sound judgement on enterprise risk, investment priorities and incident response. - Earn the confidence of founders, leadership, partners and governance stakeholders. - Represent Decentro credibly in executive, regulatory, audit and partner discussions. **Why join Decentro** You will own the complete security and information security charter across a four-entity fintech group and work directly with the CEO and founders on decisions that shape the business. This is an opportunity to build a strong security organisation, stay close to the technology and grow towards a Group CISO mandate through demonstrated impact. **What We Offer** The ability for you to make an impact and lay a foundation for upcoming fintech innovations. A multicultural and diverse team of colleagues from different states who collectively speak six Indian and global languages. Progressive and flexible work hours that match your personality and lifestyle. The best-in-class perks and benefits for the team. Check out our careers page for the same: [https://decentro.tech/careers/](https://decentro.tech/careers/) Backed by global investors such as Y Combinator & Rapyd, we’re a contrarian and progressive culture of independent thinkers and systematic executors driven to build cool things that matter. If this aligns with you, time to hop on! We are an equal opportunity employer and all qualified applicants will receive consideration for employment without regard to race, colour, religion, sex, disability status, or any other characteristic protected by law.