Product Information Security Officer

Title: Product Information Security Officer

Band: E5

Location: Noida/Bangalore

Role Overview

The Product Information Security Officer (PISO) is responsible for embedding security into product design, development, and delivery. This role bridges product management and security, ensuring that information security is a core product requirement rather than a post-release consideration. The PISO champions security best practices, manages product risk, and drives a security-conscious product culture.

Key Responsibilities

1. Product Security Architecture & Design

• Define and maintain product security architecture and threat models

• Conduct threat modeling for new features and systems

• Lead security design reviews during product planning and architecture phases

• Establish secure-by-default principles and baseline security controls

• Review and approve authentication, authorization, and encryption strategies

2. Secure Development & Code Review

• Establish secure coding standards and guidelines

• Conduct security code reviews for high-risk features and components

• Manage static application security testing (SAST) and dynamic testing (DAST) tools

• Define and enforce secure SDLC practices (threat modeling, secure testing, secure deployment)

• Partner with engineering to shift-left security and integrate security earlier in development

3. Vulnerability & Risk Management

• Coordinate vulnerability disclosure program

• Manage product vulnerability lifecycle: triage, remediation, patch coordination

• Track and prioritize security debt; negotiate remediation timelines with product & engineering

• Maintain product risk register and escalate critical risks to CISO and executive leadership

• Perform periodic risk assessments and penetration testing

4. Compliance & Regulatory

• Interpret compliance requirements (SOC 2, ISO 27001, NIS2, GDPR, CCPA) for product teams

• Build compliance requirements into product roadmap early

• Coordinate security evidence collection and audit readiness

• Advise on data residency, encryption, and handling requirements

• Partner with Legal and Compliance teams on privacy, data protection, and contractual security obligations

5. Security Culture & Engineering Education

• Lead security training and awareness programs for engineering and product teams

• Champion OWASP, CWE, and other security frameworks and best practices

• Foster a culture of shared security responsibility; normalize security discussions

• Mentor security engineers and junior team members

6. Incident Response & Post-Mortem

• Lead response to security incidents affecting product

• Coordinate fix validation and accelerated patch deployment

• Conduct blameless security-focused post-mortems and publish lessons learned

• Drive prevention of recurrence through architecture or process changes

7. Third-Party & Dependency Management

• Manage vendor security assessments and risk evaluation

• Define and implement software composition analysis (SCA) and dependency scanning

• Establish supply chain security practices (sign, verify, binary authorization)

• Evaluate security implications of new libraries, frameworks, and tools before adoption

8. Security Metrics & Reporting

• Define and track product security KPIs (MTTR, vulnerability density, code coverage, etc.)

• Produce monthly/quarterly security dashboards for product, engineering, and leadership

• Report to Product Leadership and CISO organization

Required Qualifications

Education & Certifications:

• BS in Computer Science, Information Security, or equivalent professional experience

• CISSP, CCSK, or equivalent security certification

Experience:

• 10+ years in information security, with 5+ years in product security or application security roles

• Demonstrated experience shipping secure SaaS products at scale

• Experience with threat modelling, secure SDLC, and vulnerability management

• Hands-on experience with security testing tools (SAST, DAST, IAST, SCA)

• Experience with compliance frameworks (SOC 2, ISO 27001, HIPAA, GDPR, etc.)

Technical Skills:

• Deep understanding of application security, network security, and cryptography

• Proficiency with secure coding practices (OWASP Top 10, CWE, etc.)

• Familiarity with modern development practices (CI/CD, containerization, microservices, cloud

platforms)

• Ability to read and understand code; ideally hands-on coding ability in common languages

• Experience with security architecture and design patterns

Soft Skills:

• Excellent communication; ability to explain security concepts to non-technical audiences

• Ability to influence without authority; strong stakeholder management

• Collaborative mindset; comfortable working with product, engineering, and business teams

• Strategic thinker with attention to detail and strong project management skills

• Comfort with ambiguity and competing priorities; ability to prioritize ruthlessly

Preferred Qualifications

• OSCP (Offensive Security Certified Professional) or similar hands-on penetration testing cert

• Background in product management or start-up/scaling experience

• Published security research, conference talks, or open-source security contributions

Security-Focused KPIs & Metrics

Vulnerability & Risk Management:

• Mean Time To Remediate (MTTR) for critical vulnerabilities

• Mean Time To Remediate (MTTR) for high vulnerabilities

• Number of vulnerabilities discovered post-release

• Active security debt items tracked and prioritized in roadmap

• Security architecture improvements: # of systems transitioned to secure-by-design patterns