Credilio Financial Technologies Pvt. Ltd.

Job Summary

We are looking for an Information Security & Compliance Officer to own and drive information security governance, risk management, audit readiness, compliance execution, and cybersecurity coordination.

The person will maintain compliance readiness across ISO 27001, PCI DSS, DL-SAR, CICRA, bank/partner audits, RBI requirements, Digital Lending Guidelines, and data protection requirements, while supporting readiness for ISO 27701, SOC 2 Type 2, DPDP, and other future compliance needs.

Responsibilities

·      Own and drive information security governance, risk management, compliance, and audit readiness.

·      Manage the audit and compliance calendar, including bank audits, regulatory reviews, partner reviews, security questionnaires, and external assessments.

·      Maintain audit and compliance readiness for ISO 27001, PCI DSS, DL-SAR, CICRA, RBI Cyber Security Framework, Digital Lending Guidelines, DPDP/data privacy, and other applicable requirements.

·      Maintain policies, procedures, risk registers, audit evidence, compliance trackers, security documentation, and closure reports.

·      Conduct and coordinate internal reviews for access control, privileged access, policy compliance, vendor security, cloud security, and security configurations.

·      Coordinate VAPT, source code reviews, cloud security reviews, configuration reviews, SAST/DAST activities, and remediation tracking.

·      Work with Technology, DevOps, IT, Compliance, HR/Admin, vendors, and business teams to close vulnerabilities, audit findings, security gaps, incidents, and risks.

·      Own and drive security incident response execution, including escalation coordination, RCA tracking, corrective actions, evidence documentation, closure reports, and periodic drills.

Required Skills

·      Good understanding of information security, GRC, IT risk, audits, compliance, and cybersecurity controls.

·      Working knowledge of application security, API security, cloud security, IAM, vulnerability management, incident response, secure SDLC, and vendor security.

·      Understanding of ISO 27001, PCI DSS, RBI Cyber Security Framework, Digital Lending Guidelines, banking/fintech requirements, and data protection requirements.

·      Ability to assess technical security risks, define controls, and coordinate remediation with technical teams.

·      Strong audit handling, evidence management, documentation, communication, follow-up, and ownership.

·      Ability to work independently with auditors, banks, vendors, technical teams, and business stakeholders.

Required Qualification

·      3–8 years of experience in information security, GRC, IT risk, cybersecurity coordination, audit, or compliance.

·      Experience handling bank audits, regulatory audits, ISO 27001, PCI DSS, VAPT coordination, access reviews, risk registers, audit evidence, and remediation tracking is preferred.

·      Experience in fintech, banking, NBFC, payments, lending, or regulated technology environments is preferred.

·      Bachelor’s degree in Computer Science, IT, Information Security, or a related field.

Relevant certification preferred, such as ISO 27001 LA/LI, CISA, CISM, PCI DSS, ISO 27701, Security+, CEH, or equivalent.

We are looking for a hands-on Data Engineer to help build and manage our data platform for reporting, analytics, and future data science use cases.

The role will involve working with SQL, Python, PySpark, AWS, ETL/ELT pipelines, data warehouses, and BI/reporting tools. Our architecture may use technologies such as ClickHouse, Redshift, AWS Glue, Airflow, Step Functions, Lambda, S3, and CDC-based replication tools based on scale, cost, and operational needs.

Key Responsibilities

·     Design, build, and maintain scalable ETL/ELT data pipelines from multiple databases, applications, and external systems.

·     Build raw, cleaned, and business-ready data layers to support reporting, analytics, and future data science use cases.

·     Write efficient SQL, Python, and PySpark jobs for data ingestion, transformation, validation, and processing.

·     Implement workflow orchestration using Apache Airflow, AWS Glue, Step Functions, or similar tools.

·     Work with data warehouses such as ClickHouse, Redshift, Snowflake, BigQuery, or similar.

·     Support cross-service reporting as the architecture moves towards independent microservice databases.

·     Build reusable reporting tables, aggregates, summaries, and basic data marts.

·     Monitor, troubleshoot, and optimize data pipelines, warehouse queries, and processing jobs.

·     Implement data quality checks for freshness, completeness, consistency, duplicates, and reconciliation.

·     Support BI/reporting needs through tools such as Power BI, Metabase, Superset, Redash, or similar.

·     Apply data governance, access control, security, and PII-handling best practices.

·     Collaborate with engineering, DevOps, product, business, finance, risk, and support teams.

Required Skills

·     Strong expertise in SQL for joins, aggregations, window functions, query optimization, and analytical reporting.

·     Hands-on experience with Python for data processing, automation, validation, and scripting.

·     Working experience with PySpark / Apache Spark for processing large datasets.

·     Good understanding of ETL/ELT pipelines, data warehousing, and data modelling concepts.

·     Experience with workflow orchestration using Apache Airflow, AWS Step Functions, AWS Glue, or similar tools.

·     Experience with AWS data services such as S3, Glue, Lambda, Step Functions, Redshift, DMS, CloudWatch, or similar.

·     Experience with any data warehouse such as ClickHouse, Redshift, Snowflake, BigQuery, or similar.

·     Understanding of relational databases, preferably PostgreSQL.

·     Ability to debug data mismatches, failed pipelines, slow queries, and data quality issues.

·     Exposure to BI tools such as Power BI, Metabase, Superset, Redash, or similar.

Good ownership, problem-solving, communication, and collaboration skills.

We are looking for an experienced SDE-3 Backend Engineer (Node.js) to lead the backend engineering pod responsible for third-party integrations, observability, and engineering support.

The role requires someone who is technically strong in Node.js, TypeScript, databases, and backend system design, and who can remain hands-on while guiding engineers and working closely with internal teams and external partners.

Key Responsibilities

• Own delivery, quality, and production stability for third-party
• integrations, observability, and engineering support.
• Own technical design, architecture decisions, code reviews, and delivery quality for services owned by the pod.
• Drive strong engineering practices across design reviews, code reviews, testing, documentation, release discipline, and operational readiness.
• Design, build, and maintain scalable backend services and APIs using Node.js and TypeScript.
• Own integrations with banks, payment partners, fintech partners, and other external systems.
• Ensure partner integrations are reliable, secure, well-documented, and easy to support.
• Build monitoring, alerting, dashboards, and visibility across critical services and partner workflows.
• Create and maintain runbooks, SOPs, dashboards, and troubleshooting guides for critical services and partner workflows.
• Drive timely resolution of production issues, partner issues, and internal escalations.
• Perform RCA for incidents and ensure long-term fixes are implemented.
• Mentor junior engineers and improve engineering practices within the pod.

• Strong hands-on experience in Node.js and TypeScript backend development.
• Strong database skills, including schema design, query optimization, indexing, transactions, and performance tuning.
• Strong understanding of building scalable, performant, resilient, and fault-tolerant backend systems.
• Experience with third-party integrations, webhooks, callbacks, retries, timeouts, and error handling.
• Strong debugging and production issue resolution skills.
• Experience with logging, monitoring, alerting, dashboards, and observability tools is preferred.
• Good understanding of secure API design, authentication, authorization, and data protection.
• Exposure to AWS, Docker, Kubernetes, CI/CD, Grafana, Prometheus, ELK, or similar tools.
• Ability to guide and mentor engineers while remaining hands-on.
• Ability to drive delivery, manage technical execution, and ensure quality within the pod.
• Strong communication skills for working with internal teams and external stakeholders.

DevOps Engineer

We are looking for a hands-on DevOps Engineer to manage and scale our cloud infrastructure, Kubernetes-based microservice deployments, monitoring systems, and data engineering infrastructure.

The person will be responsible for building reliable, secure, scalable, and cost-efficient infrastructure using automation-first practices. This role is important for supporting a high-growth B2C platform where availability, deployment velocity, observability, security, and cost efficiency are critical.

Key Responsibilities

• Manage and automate cloud infrastructure using Terraform.
• Deploy, manage, and troubleshoot microservices on Kubernetes.
• Build and maintain CI/CD pipelines to ensure reliable, controlled deployments.
• Implement safe release practices, including rolling deployments, rollback, and zero-downtime deployments.
• Manage monitoring, logging, alerting, dashboards, and production runbooks.
• Support incident response, production debugging, RCA, and preventive action closure.
• Ensure infrastructure is scalable, secure, highly available, and cost-optimised.
• Support data engineering infrastructure, including ClickHouse, PeerDB, Airflow, Kafka, and related platform components.
• Maintain infra-level security controls, backups, disaster recovery, and access governance.

Required Skills

• Strong experience with Terraform, Infrastructure as Code, and AWS.
• Strong experience with Kubernetes, Docker, Helm, ingress, and autoscaling.
• Experience with CI/CD tools such as GitHub Actions, GitLab CI, Jenkins, ArgoCD, or similar.
• Experience with monitoring and observability tools such as Prometheus, Grafana, ELK/OpenSearch, New Relic, or similar.
• Good understanding of cloud networking, DNS, load balancers, VPC/VPN, SSL/TLS, firewalls, and WAF.
• Experience with Linux administration, shell scripting, and automation.
• Understanding of cloud security, IAM, secrets management, and access governance.
• Exposure to databases, queues, caches, and data infrastructure tools such as ClickHouse, PeerDB, Airflow, Kafka, or similar.
• Strong debugging and problem-solving skills during production incidents.
• Ability to work closely with engineering teams to improve deployment, monitoring, cost, and reliability. 

Location: Mumbai, Andheri

Work Mode: WFO(Monday- Friday)

Notice Period: Immediate/30 Days

Job Summary: Focus on supporting audit processes with regulatory bodies including RBI, Banks, and other financial institutions. Maintain compliance with multiple frameworks such as ISO 27001, PCI-DSS etc. Conduct regular internal security assessment & provide InfoSec training.  

Required Skills and Knowledge

Working knowledge of:

• Information security concepts and principles

• Basic networking and system security

• Windows and Linux operating systems

• Common security tools and technologies

• Audit management systems

Compliance knowledge & understanding of:

• ISO 27001 framework and implementation

• Data protection regulations

• PCIDSS requirements and controls

• RBI's Cyber Security Framework

• Banking sector regulatory requirements

Required Experience /Qualifications

2-6 years of experience in information security, audit, or compliance roles

• Previous exposure to regulatory audits is highly desirable.

• Experience in banking/financial services sector is a plus

• Bachelor’s degree in computer science, Information Technology, Information Security, or related field.

Certifications (Any one of the following preferred):

• CompTIA Security+

• CISA

• ISO 27001 Lead Auditor

• Other Industry Certifications 

Principal Duties/Responsibilities

• Act as a liaison between external auditors and internal teams during regulatory audits.

• Coordinate with RBI auditors, banking auditors, and other regulatory bodies.

• Prepare comprehensive audit evidence packages according to regulatory requirements.

• Maintain audit calendars and tracking systems for various regulatory assessments.

• Create and maintain audit trails for all regulatory interactions.

• Assist in maintaining compliance with multiple frameworks: Payment Card Industry Data Security Standard (PCIDSS) ISO 27001 Information Security Management System RBI's Cyber Security Framework Banking regulatory requirements

• Help conduct regular internal assessments against compliance requirements.

• Support the implementation and documentation of security controls

• Monitor compliance status and help prepare compliance dashboards

• Support internal security assessments and reviews: Access control reviews User privilege assessments Security configuration reviews

Policy compliance checks

• Document security findings and observations

• Help create and maintain security control documentation

• Perform risk assessment.

• Support vulnerability assessment and penetration testing coordination • Contribute to the development of audit checklists and templates

• Keep updated with latest regulatory requirements and security standards