About the Opportunity:

We are hiring on behalf of a management and technology advisory firm that provides strategic consulting, governance, risk management, cybersecurity, and business transformation services to organizations. The firm works with clients to strengthen enterprise security, manage technology risks, and establish robust governance and compliance frameworks.

The organization is seeking a highly experienced Chief Information Security Officer (CISO) Consultant to provide strategic cybersecurity leadership, assess enterprise security maturity, establish security governance frameworks, and guide organizations in protecting their critical information assets.

This is a senior-level consulting engagement suitable for experienced CISO professionals, independent consultants, cybersecurity advisors, and freelance security leaders who can work on a contractual basis for three days per week.

Key Responsibilities:

1. Cybersecurity Strategy and Leadership:

- Develop and implement enterprise-wide cybersecurity strategies aligned with business objectives.

- Define the organization's information security vision, roadmap, policies, standards, and operating models.

- Conduct cybersecurity maturity assessments and identify gaps in people, processes, and technology.

- Advise senior management, executive leadership, and boards on cyber risks, security investments, and risk mitigation priorities.

- Establish security metrics, KPIs, KRIs, and executive-level security reporting.

2. Information Security Governance, Risk and Compliance (GRC):

- Establish and oversee information security governance frameworks, policies, procedures, and controls.

- Lead enterprise-wide Information Security Risk Assessments and maintain risk registers.

- Implement and assess frameworks such as ISO/IEC 27001, NIST Cybersecurity Framework (CSF), NIST SP 800-53, CIS Controls, and COBIT.

- Ensure compliance with applicable regulatory, contractual, and industry-specific security requirements.

- Oversee internal and external security audits, compliance assessments, remediation plans, and evidence management.

- Support risk-based decision-making, control testing, exception management, and continuous compliance improvement.

3. Technical Cybersecurity Architecture and Engineering:

- Provide strategic oversight of enterprise security architecture across on-premises, cloud, hybrid, and distributed environments.

- Review and guide security architecture for networks, endpoints, servers, applications, databases, and enterprise infrastructure.

- Evaluate and recommend security controls such as firewalls, IDS/IPS, Endpoint Detection and Response (EDR), Extended Detection and Response (XDR), Data Loss Prevention (DLP), and Security Information and Event Management (SIEM).

- Oversee Identity and Access Management (IAM), Privileged Access Management (PAM), Multi-Factor Authentication (MFA), and Zero Trust security models.

- Guide cloud security strategy across AWS, Microsoft Azure, and Google Cloud Platform, including cloud configuration, workload protection, access governance, and security posture management.

- Review secure application development practices, DevSecOps, API security, vulnerability management, and penetration-testing outcomes.

- Assess encryption, cryptographic key management, data classification, data protection, and secure data lifecycle practices.

4. Security Operations and Incident Response:

- Establish or oversee Security Operations Center (SOC) capabilities, monitoring processes, threat detection, and incident response.

- Define incident response plans, escalation procedures, crisis communication protocols, and cyber incident governance.

- Oversee threat intelligence, threat hunting, log monitoring, security analytics, and detection engineering.

- Lead or advise on major cyber incident investigations, root-cause analysis, containment, eradication, and recovery.

- Conduct tabletop exercises and cyber crisis simulations to assess organizational preparedness.

- Establish incident severity classifications, response SLAs, and post-incident corrective action plans.

5. Vulnerability Management and Offensive Security:

- Establish enterprise-wide vulnerability assessment and remediation programs.

- Oversee penetration testing, red-team exercises, security configuration reviews, and attack-surface assessments.

- Prioritize remediation based on exploitability, business criticality, exposure, and risk impact.

- Evaluate security testing reports and ensure closure of critical and high-risk findings.

- Guide threat modelling, attack-path analysis, and security-by-design practices.

6. Data Protection, Privacy and Third-Party Risk:

- Establish data protection and information handling policies, including data classification and access controls.

- Oversee Data Loss Prevention (DLP), encryption, backup security, and sensitive data protection measures.

- Guide privacy and regulatory compliance activities under applicable laws, including India's Digital Personal Data Protection Act, 2023, and other relevant requirements.

- Assess third-party, vendor, cloud service provider, and supply-chain cybersecurity risks.

- Establish security due diligence, vendor risk assessments, contractual security requirements, and ongoing monitoring.

7. Business Continuity and Cyber Resilience:

- Develop and review Business Continuity Plans (BCP), Disaster Recovery Plans (DRP), and cyber resilience strategies.

- Define recovery objectives, including Recovery Time Objective (RTO) and Recovery Point Objective (RPO).

- Assess backup and recovery controls, business-critical dependencies, and resilience against ransomware and other disruptive attacks.

- Coordinate business continuity testing, disaster recovery exercises, and lessons-learned reviews.

8. Security Culture and Stakeholder Management:

- Lead cybersecurity awareness, training, and organization-wide security culture initiatives.

- Advise business leaders on cyber risk, technology investments, and security-related business decisions.

- Work with IT, legal, compliance, audit, operations, and executive leadership teams.

- Mentor security teams and guide the development of security operating models, roles, responsibilities, and capabilities.

- Support client cybersecurity assessments, consulting engagements, strategic recommendations, and implementation oversight.

Must-Have Skills and Expertise:

- 25+ years of overall professional experience in IT, information security, cybersecurity, risk management, or technology leadership.

- Demonstrated experience as a CISO, Deputy CISO, Group CISO, Head of Information Security, or senior cybersecurity advisor.

- Proven ability to define and execute enterprise cybersecurity strategies and security transformation programs.

- Strong knowledge of security governance, risk management, audits, and regulatory compliance.

- Practical understanding of enterprise security architecture, network security, cloud security, IAM/PAM, endpoint protection, and data security.

- Experience overseeing SOC, SIEM, threat detection, incident response, vulnerability management, and penetration testing.

- Strong understanding of ISO 27001, NIST CSF, CIS Controls, and other relevant security standards.

- Experience with business continuity, disaster recovery, cyber resilience, and crisis management.

- Ability to present cybersecurity risks and recommendations to CXOs, board members, business stakeholders, and clients.

- Strong consulting, assessment, documentation, stakeholder management, and executive communication skills.

- Ability to work independently and provide strategic direction within a part-time consulting engagement.

Preferred Qualifications and Certifications:

- CISSP - Certified Information Systems Security Professional.

- CISM - Certified Information Security Manager.

- CISA - Certified Information Systems Auditor.

- CCSP - Certified Cloud Security Professional.

- CRISC - Certified in Risk and Information Systems Control.

- ISO/IEC 27001 Lead Implementer or Lead Auditor.

- Relevant cloud security certifications from AWS, Microsoft Azure, or Google Cloud.

- Certifications are advantageous, but demonstrated CISO-level leadership and hands-on oversight of enterprise security programs are essential.

Candidate Profile:

We are looking for a seasoned cybersecurity leader who combines strategic vision with strong technical depth, governance expertise, and practical risk management capabilities. The ideal candidate should be comfortable advising senior stakeholders, conducting security assessments, developing actionable roadmaps, and guiding implementation without requiring a full-time employment arrangement.

- Suitable candidates: Independent CISO consultants, freelance cybersecurity advisors, retired or semi-retired CISOs, fractional CISOs, and senior security leaders available for contractual assignments.

Important Engagement Details:

- Location: Faridabad, Haryana.

- Commitment: 3 days per week.

- Engagement: Contract / Freelance / Consulting.