Head of Security

Location: India, India

Department: Information Security

Experience: 6 - 10 Years

Skills: Application Security, Incident responses, Security Operations, Corporate Security

• Own the secure SDLC: threat modelling, security design reviews, and secure coding standards.
• Build security tooling into CI/CD: SAST, DAST, SCA, secrets scanning, and IaC scanning, with fixes that engineers can actually act on.
• Own vulnerability management for the product: triage, remediation SLAs, pen tests, and a bug bounty or responsible disclosure program.
• Secure a multi-tenant SaaS platform, including tenant isolation, authentication and authorization, API security, and data protection.
• Secure AI and LLM features against prompt injection, data leakage, and model and vendor risk.
• Work as a partner to engineering leaders so security speeds teams up instead of blocking them.
• Support SOC 2 and ISO 27001 controls and customer security reviews, working with the GRC team.

• Own Scrut's existing SOC team and MDR partnership. You'll lead the in-house SOC, manage the MDR relationship, scope, and SLAs, and keep raising the bar on 24x7 monitoring, alert triage, escalation, and response quality.
• Own detection engineering: what we log, the SIEM and EDR stack, detection rules, and tuning to cut noise.
• Own the incident response program: playbooks, severity levels, on-call, war rooms, and blameless post-incident reviews that lead to real fixes.
• Lead live incidents from detection through containment, eradication, recovery, and customer and regulatory notification.
• Run regular tabletop exercises and red team or purple team drills.
• Own threat intelligence and threat hunting for our cloud, corporate, and product environments.

• Secure corporate IT: identity and SSO, MFA, device management, endpoint protection, and email security.

• 6+ years in security.
• Battle-tested incident leadership. You've personally led response to real, high-severity incidents (breaches, ransomware, account takeovers, cloud compromises, or major vulnerabilities like Log4Shell) and can walk us through what happened, what you decided, and what you changed afterwards.
• Strong AppSec background: you've built a secure SDLC program at a SaaS company and can review architecture and code yourself.
• Experience leading an in-house SOC team and managing an MDR or MSSP provider, including holding them to SLAs, with deep familiarity with SIEM, SOAR, EDR/XDR, and cloud-native detection (AWS GuardDuty, CloudTrail, Security Hub, or equivalents).
• Solid cloud security skills, ideally AWS.
• Experience securing corporate IT and identity.
• Working knowledge of MITRE ATT&CK, OWASP Top 10 and ASVS, and NIST incident response guidance.
• Calm under pressure, a clear communicator during incidents, and able to brief both engineers and executives.

• Experience at a B2B SaaS, security, or compliance company.
• Certifications such as GCIH, GCIA, OSCP, OSWE, or CISSP.
• Digital forensics experience.
• Experience securing AI/LLM products

• A chance to make real impact early - not just be a cog in the wheel
• Rapid learning, faster growth - we don't gatekeep opportunities
• You'll work with smart, driven folks who genuinely want to build something meaningful
• Exposure to founders and leadership that actually mentor and listen
• Your ideas won't just be heard - they'll be implemented
• Competitive pay, great benefits, and policies that respect your time and energy
• We're building for a global market - your work scales beyond borders