Why are banks, NBFCs and fintechs in India hiring security leaders now?
Three forces have turned information security from a back-office function into a board-level hire for banks and NBFCs, insurers and fintechs alike.
Regulation is the first. The RBI issued its Cybersecurity, Technology Risk, Resilience and Assurance Framework on 31 July 2026, raising and consolidating the bar its 2023 Master Direction on IT Governance, Risk, Controls and Assurance Practices had already set. Together they require a board-approved information security policy, a board-level IT or security committee, and defined responsibility for a senior Chief Information Security Officer, with the weight of the requirement scaling by the size and regulatory layer of the entity. The 2026 framework goes further, requiring the CISO to report directly to an executive director or equivalent overseeing risk. Market intermediaries sit under SEBI's Cybersecurity and Cyber Resilience Framework, and every regulated firm that handles customer data now operates under the Digital Personal Data Protection Act, 2023.
Exposure is the second. Digital lending, UPI and payments volumes, cloud migration and a widening third-party stack have enlarged the attack surface faster than most firms have built the function to defend it.
Scarcity is the third. Cybersecurity is among the top hiring priorities across Indian financial services, against a national shortage running to tens of thousands of unfilled roles. The firms that move first take the few leaders who have actually run a regulated environment.
What does a CISO actually own in a regulated lender?
It is not an IT job with a security label. In a bank, NBFC or insurer a CISO owns the reporting line to the board and the audit committee, the information security policy and its annual refresh, the security operations centre and incident response, vulnerability and patch management, identity and access governance, application and cloud security as the firm ships software, and third-party and vendor risk, which is where most regulated breaches begin. They own business continuity, disaster recovery and operational resilience, the regulatory liaison and the incident reporting when something goes wrong, and increasingly the security of AI and data pipelines. In a smaller NBFC the same person often carries IT risk and the DPDP data-protection remit as well.
The part that changes the hire is the named-officer accountability. The board relies on this individual personally, and the regulator can ask for them by name. That is a different standard from a general technology role, and it is why the cost of leaving the seat open compounds in the same way a vacant senior risk seat does.
Who sits beneath the CISO, and what do those roles look like?
A working security function in financial services usually spans security engineering and SOC analysts who run detection and response day to day, a governance, risk and compliance team that maps controls to the RBI, SEBI and DPDP requirements and carries the audits, a security architect who designs controls into new products and the cloud, identity and access specialists, and, in larger or GCC-based teams, dedicated application security, cloud security and red-team capability. We map and hire across this whole stack, from the first security engineer a growth-stage fintech needs to the deputy CISO a bank needs to run the function, and we do the same for the adjacent technology risk and IT audit roles that sit alongside it.
What does information security leadership pay in India in 2026?
These are fixed-pay bands, for people changing employers, from our information security benchmarks. A Security Engineer or GRC Manager sits around Rs 18L to 35L. A Senior Manager or Security Architect sits around Rs 35L to 60L. A Deputy CISO or CISO sits around Rs 55L to 150L, the top of that band reserved for a group CISO at a large bank or a listed financial services firm.
Pay rises with the regulatory weight of the seat, not only the technical scope. A named CISO who signs to the board commands more than a technically similar role with no personal accountability. The full by-level detail sits on our information security salary benchmarks.
Why are these roles so hard to fill?
Three things compound. The pool is thin: India has a documented cybersecurity talent shortage, and the subset who have run security inside a regulated financial environment, under RBI or SEBI scrutiny, is far smaller than the headline numbers suggest. The bar is higher than a generic security role, because the named-officer accountability means a firm cannot hire on tooling knowledge alone; it needs someone who can sit in front of a board and a regulator. And retention is hard: the best security leaders are courted constantly, counter-offered, and lost during the notice period as often as at the offer stage. A search that treats this like a general technology hire tends to run long and still miss.
How do you hire a CISO without a 12-month search?
Five disciplines make the difference.
- A brief that fixes the real scope. What must this person sign to, which regulators, what is the reporting line to the board, and what budget and headcount will they own. A security-leadership search drifts when the mandate is written as a job description instead of a scope.
- A market map, not a database search. The right candidates are not applying; they are already running security somewhere. They have to be found, read and approached directly, with the regulatory context understood from the first call.
- Assessment for judgement, not keywords. Can they build a control environment a regulator accepts, explain risk to a board in plain terms, and lead a response at 2am. That is calibrated in the screen, not read off a CV.
- The named-officer conversation, early. A senior candidate weighs the personal accountability carefully, so surfacing it honestly up front separates the people who will take the seat from those who drop out once they understand it.
- Run the notice period. Senior security hires are lost between acceptance and joining, so the offer is not the finish line. The 90 days after it need managing, on the lines of our notice-period playbook.
We run this as a specialist search, on a success fee, with the domain understood from the first conversation. If you are hiring a CISO or building the function beneath one, tell us about the role.
Common questions on hiring a CISO in financial services
Does an NBFC need a CISO?
In substance, yes. Under the RBI's IT governance direction and its 2026 cybersecurity framework, NBFCs must have board-approved information security governance and a designated senior security officer, with the depth of the requirement scaling by the NBFC's regulatory layer and size. Larger and upper-layer NBFCs are expected to have a dedicated CISO.
What does a CISO cost in India in 2026?
A CISO or deputy CISO in financial services sits around Rs 55L to 150L in fixed pay, by entity size and the regulatory weight of the seat. The by-level ranges, including the roles beneath the CISO, are on our information security benchmarks.
What is the difference between a CISO and a Head of IT Security?
A Head of IT Security runs the controls. A CISO owns the risk to the board and the regulator and signs for it. In a regulated financial firm the distinction is the personal accountability, which is why the two command different pay and are assessed differently.
How long does it take to hire a CISO?
A well-briefed specialist search typically runs four to six weeks to a calibrated shortlist, with the notice period managed afterward. A generalist search for the same seat often runs several months and still risks dropout.