Head of Information Security

Job Description – Information Security Lead

Organizational Overview

Yanolja Cloud Solution Pvt. Ltd. (YCS) is a global end-to-end hospitality technology provider specializing in solutions for small and medium-sized accommodation businesses.

With more than 400+ team members and 20+ years of experience, YCS currently serves 40,000+ customers across 170+ countries, with 50+ supported languages in our software and a 24/7 support network.

We have local teams across 15+ countries, including India, Thailand, Indonesia, Philippines, Sri Lanka, South Africa, Tanzania, Uganda, USA, Mexico, and counting.

Position Overview

We are looking for an experienced Information Security Lead with a minimum of 10 years of professional experience in cybersecurity and information security to lead and strengthen the security posture of YCS's SaaS products, applications, APIs, cloud infrastructure, internal systems, and customer data.

This is a senior technical leadership role requiring a strong combination of application security, API security, AWS/cloud security, incident response, vulnerability management, security architecture, DevSecOps, and security governance .

The ideal candidate will be capable of independently investigating complex security incidents, challenging technical architecture, working closely with engineering teams, establishing security standards, and driving security vulnerabilities and risks through remediation and closure.

This is not intended to be a purely governance, audit, or SOC-monitoring role. The candidate is expected to remain technically hands-on while providing security leadership across the organization .

Key Responsibilities

1. Information Security Ownership

• •Own and continuously improve the overall information security posture of the organization.
• •Establish security priorities based on business risk, customer impact, and technical exposure.
• •Develop and maintain the organization's security roadmap in collaboration with the CTO and engineering leadership.
• •Act as the primary technical security authority for product, application, API, cloud, and infrastructure security matters.
• •Define security standards, controls, procedures, and technical guidelines.
• •Track security risks and ensure identified issues are driven to closure.

2. Application & API Security

• •Lead security reviews of web applications, APIs, backend services, integrations, and customer-facing platforms.
• •Identify and address vulnerabilities including broken authentication, broken authorization, IDOR/BOLA, injection vulnerabilities, XSS, sensitive data exposure, insecure API endpoints, security misconfigurations, weak session management, and improper tenant isolation.
• •Ensure applications follow OWASP Top 10 and OWASP API Security best practices.
• •Review authentication and authorization mechanisms including OAuth 2.0, JWT, access tokens, refresh tokens, API keys, service-to-service authentication, and RBAC.
• •Review the security of third-party and partner APIs.
• •Work directly with engineering teams to remediate security weaknesses.

3. Multi-Tenant SaaS Security

• •Review and strengthen security controls for multi-tenant SaaS applications.
• •Ensure proper logical separation of customer and tenant data.
• •Validate tenant-level authorization controls across APIs, services, databases, and administrative functions.
• •Identify risks that could allow one customer or hotel to access another customer's information.
• •Review authorization architecture for internal systems, customer applications, and third-party integrations.
• •Ensure sensitive operations have appropriate access controls and audit trails.

4. Cloud & AWS Security

• •Own security reviews of AWS infrastructure and cloud architecture.
• •Review and improve IAM users, roles and policies, privileged access, security groups, VPC and network architecture, S3 permissions, databases, secrets management, encryption, cloud logging, key management, and publicly exposed services.
• •Identify excessive permissions and privilege-escalation risks.
• •Establish least-privilege access across AWS environments.
• •Review cloud architecture before deployment of critical systems.
• •Work closely with DevOps and infrastructure teams to remediate cloud security findings.
• •Ensure appropriate monitoring and alerting using AWS security services and centralized monitoring platforms.

5. Security Incident Response & Investigation

• •Lead investigation of security incidents including suspected customer-data leakage, unauthorized access, credential compromise, malware infections, API misuse, suspicious login activity, cloud compromise, insider threats, and endpoint compromise.
• •Determine incident scope, timeline, root cause, impact, and attack path.
• •Coordinate containment, eradication, recovery, and post-incident remediation.
• •Perform or coordinate forensic analysis across application, database, API, AWS, endpoint, authentication, and network logs.
• •Maintain appropriate evidence and incident documentation.
• •Conduct post-incident reviews and ensure corrective actions are completed.
• •Develop and maintain incident-response playbooks and escalation procedures.

6. Vulnerability Management

• •Own the organization's vulnerability-management program.
• •Establish processes for vulnerability identification, prioritization, remediation, verification, and closure.
• •Manage vulnerabilities identified through penetration testing, SAST, DAST, Software Composition Analysis, cloud-security scans, infrastructure scans, container scans, and security assessments.
• •Prioritize vulnerabilities based on severity, exploitability, internet exposure, customer impact, data sensitivity, and business risk.
• •Define vulnerability-remediation SLAs and escalate overdue critical and high-risk vulnerabilities.
• •Validate security fixes before closing findings.
• •Identify recurring vulnerability patterns and drive systemic improvements.

7. Secure SDLC & DevSecOps

• •Establish and mature Secure SDLC practices.
• •Work with engineering leadership to embed security throughout product development.
• •Participate in architecture and design reviews for critical features.
• •Perform threat modeling for high-risk systems and functionality.
• •Define security requirements before development begins.
• •Integrate automated security controls into CI/CD pipelines, including SAST, DAST, dependency scanning, secret scanning, container scanning, and Infrastructure-as-Code scanning.
• •Establish secure coding guidelines.
• •Conduct security-focused code reviews when required.
• •Help engineering teams understand security vulnerabilities and remediation techniques.
• •Ensure security becomes an engineering responsibility rather than an end-stage compliance activity.

8. Security Architecture

• •Conduct security architecture reviews for new products, major product changes, cloud architecture, APIs, third-party integrations, authentication systems, payment integrations, and customer-data workflows.
• •Identify security threats during design rather than after production deployment.
• •Recommend preventive, detective, and corrective controls.
• •Review trust boundaries, access flows, privilege models, and data flows.
• •Ensure security architecture supports scalability without compromising tenant or customer isolation.

9. Identity & Access Management

• •Establish and review identity and access-management controls.
• •Ensure implementation of least privilege, MFA, RBAC, privileged-access management, Joiner-Mover-Leaver processes, and periodic access reviews.
• •Review privileged user and administrator activity.
• •Identify shared, dormant, unnecessary, or excessive accounts.
• •Review service accounts, API credentials, tokens, and machine identities.
• •Ensure credentials are securely generated, stored, distributed, rotated, and revoked.

10. Security Logging, Monitoring & Detection

• •Define security logging requirements for applications and infrastructure.
• •Ensure appropriate logging across A