Board Cybersecurity Adviser — Digital Payments

The mandate

Directors keep encountering the same uncertainty: security investment is rising, yet they cannot tell whether the payment platform can absorb a destructive cloud, identity or supplier event without prolonged customer harm. Growth into credit-linked journeys makes that uncertainty more consequential.

The cadence is three days a month: a CISO review, one deep dive with engineering or operations, and attendance at the relevant Risk or Technology Committee. A suspected material incident triggers a two-hour acknowledgement and availability for a chair-led call within six hours.

The twelve-month term is fixed and non-renewable, with the nominations committee reviewing contribution and independence at close. This adviser holds no line authority, incident-command role or executive responsibility and cannot direct the CISO, approve controls or speak for the company.

Only two other board or advisory retainers may run concurrently. Any relationship with a competing payments network, outsourced processor, cloud provider, security vendor, forensic firm or cyber insurer serving the company requires full disclosure and possible recusal.

Why the board wants this voice

Cyber reporting currently emphasises activity counts and audit closures. The board needs someone who has made decisions through a high-severity financial-services incident and can interrogate survivability rather than compliance appearance. The adviser will raise the quality of challenge without displacing management.

What you will own

• Reframe cyber reporting around plausible loss scenarios, service recovery, customer exposure and management decision points.
• Challenge the assumed blast radius of privileged-access, software-supply-chain and cloud-control-plane compromise.
• Test whether incident playbooks specify business authority, regulatory communications and customer-remediation triggers.
• Press the committees on concentration risk across processors, telecom links, identity services and hyperscale infrastructure.
• Shape an annual resilience exercise that includes irreversible data corruption and simultaneous fraud pressure.
• Guide scrutiny of security exceptions whose commercial rationale has outlived their original approval.
• Advise committee chairs on the evidence required before declaring a major remediation programme complete.

Candidate qualifications

• 22–28 years across cybersecurity, technology risk or operational resilience in regulated payments or banking.
• First-hand leadership during at least one severe cyber or technology incident affecting transaction availability.
• Experience presenting threat scenarios, control gaps and recovery trade-offs directly to board committees.
• Technical grasp of cloud identity, payment processing, software supply chains, fraud interfaces and immutable recovery.
• Record of assessing critical vendors without commercial dependence on their products or services.
• Familiarity with Indian financial-sector cyber reporting and incident-notification expectations.

Non-negotiables

• Six-hour availability for a chair-led call when a potentially material incident is declared.
• Complete disclosure of security-vendor, insurer, forensic and competing-payments interests.
• No operational command, public spokesperson or assurance-sign-off role under this appointment.
• In-person Gurugram attendance for quarterly board simulations and scheduled committee meetings.

1. 49 words maximum. Describe the most consequential payments or banking cyber incident you helped govern and the board decision you influenced.
2. 49 words maximum. Which vendors, insurers, forensic firms or competing platforms create an actual or perceived conflict for you?
3. 49 words maximum. Can you meet a two-hour acknowledgement and six-hour board-call expectation during a suspected material incident?