Head of Security

Title: Head of Security Location: Bangalore, India Remote
About the role We want a hands-on security leader who has been in the room when things broke and led the response. You'll own Scrut's application security, security operations, and corporate security, and be the person customers and leadership trust when something goes wrong.
What you'll own
Application security
- Own the secure SDLC: threat modelling, security design reviews, and secure coding standards.
- Build security tooling into CI/CD: SAST, DAST, SCA, secrets scanning, and IaC scanning, with fixes that engineers can actually act on.
- Own vulnerability management for the product: triage, remediation SLAs, pen tests, and a bug bounty or responsible disclosure program.
- Secure a multi-tenant SaaS platform, including tenant isolation, authentication and authorization, API security, and data protection.
- Secure AI and LLM features against prompt injection, data leakage, and model and vendor risk.
- Work as a partner to engineering leaders so security speeds teams up instead of blocking them.
- Support SOC 2 and ISO 27001 controls and customer security reviews, working with the GRC team.
Security operations and incident response
- Own Scrut's existing SOC team and MDR partnership. You'll lead the in-house SOC, manage the MDR relationship, scope, and SLAs, and keep raising the bar on 24x7 monitoring, alert triage, escalation, and response quality.
- Own detection engineering: what we log, the SIEM and EDR stack, detection rules, and tuning to cut noise.
- Own the incident response program: playbooks, severity levels, on-call, war rooms, and blameless post-incident reviews that lead to real fixes.
- Lead live incidents from detection through containment, eradication, recovery, and customer and regulatory notification.
- Run regular tabletop exercises and red team or purple team drills.
- Own threat intelligence and threat hunting for our cloud, corporate, and product environments.
Corporate security
- Secure corporate IT: identity and SSO, MFA, device management, endpoint protection, and email security.

What we're looking for
- 6+ years in security.
- Battle-tested incident leadership. You've personally led response to real, high-severity incidents (breaches, ransomware, account takeovers, cloud compromises, or major vulnerabilities like Log4Shell) and can walk us through what happened, what you decided, and what you changed afterwards.
- Strong AppSec background: you've built a secure SDLC program at a SaaS company and can review architecture and code yourself.
- Experience leading an in-house SOC team and managing an MDR or MSSP provider, including holding them to SLAs, with deep familiarity with SIEM, SOAR, EDR/XDR, and cloud-native detection (AWS GuardDuty, CloudTrail, Security Hub, or equivalents).
- Solid cloud security skills, ideally AWS.
- Experience securing corporate IT and identity.
- Working knowledge of MITRE ATT&CK, OWASP Top 10 and ASVS, and NIST incident response guidance.
- Calm under pressure, a clear communicator during incidents, and able to brief both engineers and executives.
Nice to have
- Experience at a B2B SaaS, security, or compliance company.
- Certifications such as GCIH, GCIA, OSCP, OSWE, or CISSP.
- Digital forensics experience.
- Experience securing AI/LLM products
Why should this job excite you?
- A chance to make real impact early - not just be a cog in the wheel
- Rapid learning, faster growth - we don't gatekeep opportunities
- You'll work with smart, driven folks who genuinely want to build something meaningful
- Exposure to founders and leadership that actually mentor and listen
- Your ideas won't just be heard - they'll be implemented
- Competitive pay, great benefits, and policies that respect your time and energy
- We're building for a global market - your work scales beyond borders

About Us Scrut Automation is an information security and compliance monitoring platform aimed at helping small and medium cloud-native enterprises develop and maintain a robust security posture and comply with various infosec standards such as SOC 2, ISO 27001, GDPR, and the like with ease. With the help of the Scrut platform, customers reduce their manual effort for security and compliance tasks by 70% and build real-time visibility of their security posture. Founded by IIT/ISB/McKinsey alumni, the founding team has over 15 years of combined Infosec experience. Scrut is built out of India for the world, with customers across India, APAC, North America, Europe and the Middle East. Scrut is backed by Lightspeed Ventures, MassMutual Ventures and Endiya Partners, along with prominent angels from the global SaaS community.
Note: Due to a high volume of applications, only shortlisted candidates will be contacted. Thank you for your understanding.