Chief Information Security Officer (CISO)

Overview

Serve as the entity-level Chief Information Security Officer (CISO) for PayPal Payments Private Limited (PPPL), India subsidiary of PayPal Holdings, Inc., leading information security, cyber resilience, and ICT risk management as the First Line of Defense lead.

What you'll do

• Serve as the entity-level CISO, leading local information security, cyber resilience, and ICT/IT risk management activities
• Lead the implementation and continuous improvement of cyber and digital operational resilience capabilities across the regulated entity
• Partner with global Infrastructure, Cloud, Cybersecurity, Site Reliability Engineering, Product, and Operations teams to strengthen the resilience of critical ICT services and business processes supporting the entity
• Ensure enterprise cybersecurity policies, standards, and control requirements are effectively implemented, monitored, and evidenced within the entity, and mapped to applicable RBI requirements
• Oversee operational resilience activities, including disaster recovery exercises, cyber simulations, failover testing, tabletop exercises, and resilience validation, and maintain evidence for regulatory and audit review
• Oversee adherence to payment data storage and localisation requirements applicable to the entity, coordinating with global teams on data residency, retention, and evidencing
• Act as the First Line ICT/IT Risk lead for major technology changes, cloud migrations, new product launches, and transformation initiatives affecting the regulated entity
• Lead ICT and cybersecurity risk assessments across infrastructure, applications, cloud services, third-party providers, and operational processes
• Ensure security, resilience, data protection, and regulatory requirements are embedded throughout technology delivery and operational processes
• Partner with engineering and product teams to drive practical, measurable, and risk-based remediation of identified control gaps, including time-bound closure of vulnerabilities identified through VA/PT
• Oversee cybersecurity and operational resilience risks associated with third-party technology providers and cloud services supporting the regulated entity
• Lead the First Line coordination of cybersecurity incidents and ICT disruption events in partnership with global Cybersecurity and Technology teams, including assessment, escalation, root cause analysis, recovery, and remediation tracking
• Drive post-incident reviews and resilience improvements to strengthen operational readiness and reduce future risk
• Act as the primary local point of contact for the RBI, CERT-In, external auditors, and internal assurance on cybersecurity, ICT risk, operational resilience, and data protection matters
• Monitor the effectiveness of cybersecurity and resilience controls, ensuring timely remediation of identified risks and control deficiencies
• Develop and report cybersecurity, operational resilience, and ICT risk metrics, Key Risk Indicators (KRIs), and management reporting, including inputs to the Board and IT Steering Committee
• Ensure the entity maintains compliance with applicable cybersecurity, ICT risk, operational resilience, data protection, and technology governance requirements under the RBI and other Indian regulatory frameworks, while aligning with PayPal's global security standards
• Advise senior management on cyber risk, technology risk, regulatory developments, resilience readiness, and emerging threats, escalating material risks where appropriate
• Partner with global Cybersecurity, Technology, Risk, Compliance, and Legal teams to align enterprise security capabilities with local regulatory expectations and business priorities
• Recognized as a security governance, risk, and compliance expert, independently addressing the most complex security risks and providing strategic direction on risk mitigation and governance practices
• Define methods and procedures for new or special assignments, collaborating with cross-functional teams to drive security risk and governance initiatives aligned with business needs and objectives
• Lead a security risk and governance team, setting clear priorities and actionable plans aligned with organizational goals, and guide team members through complex challenges

What you'll need

• 8+ years relevant experience and a Bachelor's degree, or any equivalent combination of education and experience
• 10-12 years of experience in information security, cybersecurity, ICT/IT risk, technology operations, or cyber resilience within financial services, payments, fintech, or other highly regulated technology environments
• Demonstrated experience leading cybersecurity, ICT risk, or operational resilience initiatives while partnering closely with engineering, infrastructure, cloud, and technology teams
• Experience operating within a First Line of Defense function or in a technology leadership role with accountability for security, resilience, or operational risk outcomes
• Strong understanding of modern technology environments, including cloud platforms, distributed infrastructure, enterprise applications, cybersecurity operations, and secure technology delivery
• Sufficient technical proficiency to provide credible oversight, assessment, and challenge across cyber and operational resilience, disaster recovery and resilience testing, incident management and response, ICT risk assessment, secure technology change, and vulnerability management
• Experience engaging with regulators, external auditors, and internal assurance functions within regulated financial services environments
• Working knowledge of the Indian regulatory landscape applicable to non-bank Payment System Operators / payment aggregators, including the RBI (Information Technology Governance, Risk, Controls and Assurance Practices) Directions, 2023; the RBI Master Direction on Cyber Resilience and Digital Payment Security Controls for non-bank PSOs, 2024; the RBI Guidelines on Regulation of Payment Aggregators and Payment Gateways; CERT-In Directions (2022); and the DPDP Act, 2023
• Familiarity with recognised security and resilience standards (PCI DSS, ISO/IEC 27001, NIST Cybersecurity Framework)
• Experience influencing technical and business stakeholders and driving cross-functional initiatives in complex, matrixed organisations
• Strong regulatory interpretation: ability to read and apply RBI, CERT-In, and DPDP requirements, translate principle-based guidance into practical control and evidence expectations, and form and defend a reasoned position with regulators, auditors, and internal stakeholders
• Ability to make sound, risk-based decisions during cyber incidents, operational disruptions, and rapidly evolving situations, including under compressed regulatory reporting timelines
• Excellent written and verbal communication: ability to produce clear regulatory correspondence, control narratives, incident reports, and executive- and Board-level summaries
• Strong leadership skills with a collaborative and hands-on approach to driving cybersecurity and resilience outcomes

Nice to have

• Experience engaging with the RBI, CERT-In, or other Indian authorities
• Exposure to international frameworks such as DORA, PSD2, GDPR, or NIS2
• Familiarity with cloud-native technologies, infrastructure resilience, security tooling, automation, and modern engineering operating models
• Experience with governance, risk, and compliance (GRC) platforms, operational risk tooling, and executive risk reporting

Details

• Locations: Mumbai, Maharashtra, India; Tamil Nadu, India (Virtual); Karnataka, India (Virtual)
• Hybrid work model: 3 days in the office and 2 days at PayPal office or home workspace for most employees
• Subsidiary: PayPal Travel