NABARD CISO–CSITE 2026: 16 Cyber Roles, CISA Audit Gate & ₹40 Lakh Lead Auditor Band

NABARD CISO–CSITE 2026: where the sixteen openings actually sit

NABARD Advertisement No. 04, dated 9 October 2026, invites online applications for 16 Specialists on Contract at the Bank's Head Office in Mumbai. The four roles within the Chief Information Security Office (CISO) together account for eight seats; the four roles within the Department of Supervision – CSITE (DoS–CSITE) account for the remaining eight. Despite the acronym in the notice heading, there is no separately advertised Chief Information Security Officer leadership post. The CISO label identifies the office in which the first four analyst, network-defence and penetration-testing profiles operate. These appointments are specialist contracts, not regular NABARD Grade A or Assistant Manager vacancies.

One notice, eight independent post profiles: SOC (Security Operations Centre) Analyst: 3; Information Security Analyst: 3; Network Security Analyst: 1; Ethical Hacker & Penetration Tester: 1; Lead Auditor: 2; Cyber & Network Security Specialist: 2; IT Infrastructure & Banking Specialist: 2; Cyber Security Analyst: 2. Thus 8 CISO seats + 8 DoS–CSITE seats = 16, with differing mandatory certifications, ages, experience and compensation. The post names have not been turned into eight unrelated recruitment advertisements, since all share Advertisement 04 and the 9–26 October application window.

The reservation table has a very specific single OBC vacancy

The official vacancy table (notice page 2) reads SC 0, ST 0, OBC 1, EWS 0, UR 15, total 16. The sole OBC-earmarked place is in Lead Auditor, whose two places are one OBC and one UR. All the other seven profiles display UR seats only. A single OBC place in Lead Auditor cannot be distributed notionally across other roles, nor can the number of OBC seats be presented as one for every post. The absence of separately earmarked SC/ST/EWS vacancies does not by itself disqualify eligible applicants from competing for unreserved openings; applicants still need to fulfil all applicable conditions and the Bank's decision governs eligibility.

Pick the work domain before comparing annual compensation

The division between the two groups is substantive. A SOC Analyst investigates SIEM/EDR alerts and may work rotational shifts for around-the-clock event monitoring. The Information Security Analyst assesses cyber risk, control gaps, architecture and regulatory compliance, including cloud, APIs and third parties. The Network Security Analyst manages and hardens firewalls, IPS/IDS, WAF, NAC and other controls and can be called for serious incidents. An Ethical Hacker & Penetration Tester performs authorised VAPT on applications, APIs, infrastructure and networks and documents remediation.

By contrast, DoS–CSITE specialists bring independent technology-audit and supervisory evidence. The Lead Auditor oversees audit programmes and findings across banks; the Cyber & Network Security Specialist audits network, incident-response and security controls; the IT Infrastructure & Banking Specialist audits core banking, payment rails, vendor SLAs, business continuity and infrastructure; the Cyber Security Analyst performs audit-team reviews, desk scrutiny and compliance follow-up. The DoS profiles explicitly include travel for audits. A candidate should not treat a similar-sounding 'security analyst' title as proof that the CISO Information Security Analyst and the DoS Cyber Security Analyst share the same requirements.

CISO route A: a prescribed technical qualification, 60% line and separate certifications

For the four CISO profiles the notice lists qualifying alternatives of BE/B.Tech in Computer Science, Computer Engineering, IT, Electronics & Communication, Information Science, Electrical or Cyber Security; OR MCA; OR a postgraduate degree in Computer Science, IT, Cyber Security, Information Security, Computer Engineering, Information Systems, Software Engineering or Electronics & Communication Engineering. The qualification block places a minimum 60% or equivalent-grade condition against these routes. Do not read 'OR' as permission to omit a post's mandatory certificate or job experience; degree route and certification are separate gates.

• SOC Analyst, three UR places, age 24–35: mandatory Security+, CEH or a security-equivalent certification; at least three years post-qualification IT/cyber-security work handling security solutions and risk identification. SIEM-platform certification, CySA+, CHFI or Blue Team credentials are listed as desirable, not compulsory. CV evidence should map alerts, escalation, triage, incident documentation and response outcomes to the stated work.
• Information Security Analyst, three UR places, age 24–35: CISA, CISM, CISSP or a notified equivalent information-security/IT-risk/compliance certification. The experience line unusually says 'Minimum 2–4 years of post qualification experience' in Information Security/IT Risk/Cyber Security. Because the notice itself uses this range under 'minimum', do not silently convert it into a definite universal two-year or four-year threshold; a candidate near either boundary should seek NABARD clarification. In this post, ISO 27001, CRISC, CGEIT and some cloud-security certificates appear under desirable routes, not as blanket replacements for the mandatory list.
• Network Security Analyst, one UR place, age 26–38: CCNP Security or an equivalent network/infrastructure-security certification; the experience wording combines five years of IT experience and at least three years of post-qualification network-security work. The network-security component is not five additional years unless a later bank clarification says so; the practical evidence should establish both overall tenure and actual hands-on network-security work. Cisco CCNA by itself is not named as this role's mandatory CCNP Security alternative.
• Ethical Hacker & Penetration Tester, one UR place, age 25–35: CEH, OSCP, ECSA or a notified equivalent in penetration/offensive security. The PDF says 'Minimum 2–4 years of post qualification experience' in VAPT/ethical hacking, including hands-on application, API and infrastructure testing. Its exact floor is not explicitly clarified within that range. The desirable certificates include GWAPT, GPEN and OSWE/OSWA; they are not automatically substitutes for the mandatory credentials. An authorised test report, reproducible findings and fixed-vulnerability verification are more probative work samples than a purely recreational CTF claim.

DoS–CSITE route B: where CISA is mandatory and where it is not

The DoS technical-degree entry is BE/B.Tech in CSE, ECE or IT; OR a bachelor's degree in any discipline together with a master's degree in Computer Science/IT/ECE. It is not the same as the broader first-four-post engineering subject list; do not silently accept Electrical or Information Science as a DoS engineering discipline when the page does not list it. For the latter 'bachelor + master' alternative, the master's degree is an additional required qualification, not an alternative to the bachelor's qualification.

Lead Auditor: two seats (UR 1, OBC 1), age 32–45. CISA is mandatory plus at least one of CISSP, ISO 27001 Lead Auditor, or the notice's exact third expression 'Lead Implementer and CISA'. The third item has unusual/partly redundant wording; it must not be reinterpreted as 'any Lead Implementer without CISA'. Lead Auditor requires at least eight years overall IT experience, including at least five years conducting technology/IS audits in BFSI, together with experience leading audit teams. Five qualifying audit years are a subset of the eight-year career requirement; this is not a 13-year condition. Bank audit evidence, findings, closure records and team leadership are decisive in explaining suitability. The annual remuneration band is ₹35–40 lakh, but the upper number is not guaranteed.

Cyber & Network Security Specialist: two UR seats, age 30–45. CISA is mandatory PLUS one of CCNA, CCNP, CEH or CISM. Experience: at least six years handling network devices, cyber-security consulting, ISMS, SOC or VAPT, including at least three years technology/IS audit. A strong firewall engineer with CCNP but without the separately mandated CISA should not treat CCNP as a substitute. The pay band is ₹30–35 lakh per year.

IT Infrastructure & Banking Specialist: two UR seats, age 30–45. CISA is mandatory PLUS one of CISM, ISO 27001 Lead Auditor or PCI-DSS implementation certification (PCIP/ISA/QSA/CPISI). The six-year experience must cover banking technology such as CBS, SWIFT, ATM, Internet/Mobile Banking, NEFT/RTGS/UPI/IMPS, IT infrastructure and virtualization, including at least three years in technology/IS audit. A generic systems-administration record does not by itself demonstrate the required payment-channel or audit exposure. The pay band is ₹30–35 lakh per year.

Cyber Security Analyst: two UR seats, age 24–32. The mandatory certification rule differs: at least one of CEH, ISO 27001 Lead Auditor, an Oracle/Microsoft SQL database certification or a cloud certificate in AWS/GCP/Microsoft Azure/Oracle. The official notice does not say CISA is universally mandatory for this eighth post. It requires a minimum of three years in IT or cyber security and pays ₹18–20 lakh per year. Candidates with database or cloud evidence should consider the published alternative instead of assuming every DoS role requires CISA.

Which years are overlapping, and which documents should prove them?

The Lead Auditor wording is clear: 8 overall including 5 BFSI-audit years. The two other senior DoS profiles both state 6 years including at least 3 years technology/IS audit. Likewise, the Network Security Analyst requires 5 IT years with 3 post-qualification network-security years. In each case the specified specialist period is embedded within a larger career history, not added arithmetically to it. Track dates against graduation and employment documents, and clearly identify the work performed: '5 years bank IT helpdesk' does not automatically establish '5 years BFSI IS audit'. For Information Security Analyst and Ethical Hacker, the original 'minimum 2–4 years' wording remains a stated ambiguity. A responsible eligibility summary does not invent a new precise cut-off where NABARD has not resolved it.

Age cut-off is 1 October, not the closing date

The PDF explicitly says qualifications, experience and role eligibility are as on 01.10.2026. The eight age bands are SOC 24–35, Information Security Analyst 24–35, Network Security Analyst 26–38, Ethical Hacker 25–35, Lead Auditor 32–45, Cyber & Network Security Specialist 30–45, IT Infrastructure & Banking Specialist 30–45 and Cyber Security Analyst 24–32 years. A 40-year-old cannot treat the highest 45-year ceiling as common to every post. The original PDF does not provide a numeric SC/ST/OBC/PwBD age-relaxation table, so conventional relaxation values from unrelated NABARD exams cannot be imported into this specialist advertisement.

Salary and housing: the apparent top line is not guaranteed take-home pay

The PDF (page 13) gives consolidated all-inclusive annual remuneration, by role: SOC ₹12–18 lakh; Information Security Analyst ₹12–18 lakh; Network Security Analyst ₹18–25 lakh; Ethical Hacker ₹15–24 lakh; Lead Auditor ₹35–40 lakh; Cyber & Network Security Specialist ₹30–35 lakh; IT Infrastructure & Banking Specialist ₹30–35 lakh; Cyber Security Analyst ₹18–20 lakh. These are offer ranges, not eight guaranteed amounts or regular pay levels. The stated cost to NABARD includes statutory employer-side amounts, and tax will be deducted at source. ₹40 lakh / 12 ≈ ₹3.33 lakh is only an arithmetic monthly equivalent of the top of one role's annual band, not a guaranteed in-hand salary.

A performance-based increment up to 10% may be granted at NABARD's discretion; it is not an assured 10% annual rise. The separate accommodation clause (page 14) permits bank quarters subject to availability with a licence fee of 0.5% of remuneration, or states a fixed HRA of 10% of remuneration when quarters are not allotted. Because the advertised remuneration is separately labelled 'all inclusive', applicants should confirm in the specific offer/appointment letter how any HRA entitlement is implemented rather than automatically adding 10% to the headline CTC. Medical dispensary access is for self only wherever available; official tour/halting allowances are governed by the applicable rules or appointment letter.

Contract economics: two years promised as tenure type, not five years assured

The initial engagement is two years from appointment, potentially extendable by a further three years, with reviews one year at a time and an absolute tenure limit of five years. Extensions are not automatic. Either side has the normal one-month notice arrangement, and NABARD reserves broader termination discretion under the notice; failure to serve an applicable notice period can expose a specialist to payment equivalent to that period. These appointees do not acquire a right to regular NABARD employment. The PDF explicitly excludes Provident Fund, Pension and Gratuity as superannuation benefits for specialists on this contract. Leave is generally up to 30 days per calendar year proportionately, cannot be carried forward, and additional absence restrictions apply. Someone comparing a current permanent BFSI job to an advertised ₹35–40 lakh band must account for contract risk, loss of retirement benefits, Mumbai living costs and actual offered compensation.

Interview shortlisting is formally 1:3, not a common NABARD written paper

Page 12 specifies selection by interview, with shortlist candidates in a 1:3 ratio on qualifications, experience and other suitability factors. If applied mechanically to 16 positions, the ratio suggests about 48 interview slots, but this is an illustration, not a bank-published count or promise of 48 calls. A single-vacancy post may invite only a small competitive pool. The notice does not publish a specialist common CBT, a 100-mark syllabus, a negative-marking scheme, a written-test date, or an admit-card date for this Advertisement 04. Selected candidates must also pass the Bank's pre-recruitment medical assessment. Government, quasi-government, PSU and nationalised-bank employees should have employer NOC at interview as instructed. Showing authorisation, risk impact, audit trails and result-oriented experience in an accurate CV is more pertinent than generic interview preparation for an unrelated officer exam.

Fees: zero application charge is not zero payable for SC/ST/PwBD

The fee table (page 13) separates application charge from intimation charge: SC/ST/PwBD: ₹0 application + ₹150 intimation = ₹150 before GST. Everyone else: ₹700 application + ₹150 intimation = ₹850 before GST. The table marks both totals exclusive of applicable GST. Payment-gateway transaction charges are also borne by candidates. Thus '₹850 all inclusive' and 'SC/ST/PwBD entirely free' are both incorrect. The final amount displayed at checkout is authoritative. Fee payment runs 9–26 October 2026, the same period as registration.

The application requires more than a degree PDF

Apply only through NABARD's official recruitment listing and its linked IBPS form. The notice prescribes a recent scanned colour photograph, black-ink signature, left-thumb impression in black/blue ink, and a personally handwritten English declaration in black ink; the prescribed text is supplied on notice page 15. Most candidates cannot have the declaration written by another person, and all-capitals declarations are not accepted. The application process also calls for live photograph capture, and page 19 specifically requires a latest CV/resume and proof of current Cost to Company in PDF format, each subject to the published 500 KB limit. Where no current CTC exists, do not invent a salary slip—seek guidance from the IBPS/NABARD support mechanism. The photo scan is generally 20–50 KB, signature 10–20 KB, left thumb 20–50 KB, and handwritten declaration 50–100 KB; follow each notice specification precisely rather than relying on generic bank-form upload rules.

The official IBPS registration screen distinguishes three relevant deadlines: 26 October 2026 to register/edit and pay fees, versus 10 November 2026 merely to print an application already submitted. The later printing facility does not extend new registration or payment. The notice does not supply a universal 11:59 PM closing time; do not assume an exact clock time without checking the live portal. After payment, preserve the generated e-receipt, registered-form PDF and registration credentials. The 21-page official notice says any later revisions/corrigenda will appear on NABARD's site: check that page again before filing.

Four applicant scenarios: which profile might actually fit?

Case 1: Security monitoring specialist, age 29. With a qualifying technical degree, Security+ and over three post-qualification cyber-security years involving SIEM and incident triage, the SOC profile aligns more naturally than Lead Auditor. But the Bank still decides credential equivalence and assesses all requirements.

Case 2: Network engineer with five IT years. Three years spent on firewall design and incident handling plus CCNP Security suggest a possible CISO Network Security Analyst route. For the DoS Cyber & Network Security Specialist, CCNP alone is insufficient because the notice also expressly requires CISA and an IS-audit subperiod.

Case 3: BFSI IS auditor with eight years total. Five of those years actually spent conducting technology/IS audit and experience leading teams satisfy a key Lead Auditor experience filter. The candidate must still have the notified degree route and CISA plus another acceptable certificate; being 35 does not waive those obligations. Only this post has the one reserved OBC vacancy.

Case 4: Database/cloud-security professional, age 27. A recognised Oracle/Microsoft SQL database or AWS/GCP/Azure/Oracle cloud certification may meet one mandatory credential route for DoS Cyber Security Analyst if the degree and three-year IT/cyber experience conditions also fit. That does not mean the same credential automatically meets the senior DoS CISA-plus-additional-certification requirements.

These cases explain the published AND/OR rules; they are not eligibility certificates or predictions of appointment. Applicants near the two ambiguous 'minimum 2–4 years' boundaries should seek a written clarification from NABARD rather than treating a job-board interpretation as binding.

Application questions answered from the notice

Are all 16 jobs CISO vacancies? No. Four CISO-office roles contribute 8 positions; four DoS–CSITE roles contribute 8 more.

Is the OBC vacancy available in a SOC or Ethical Hacker role? No. The advertised single OBC-earmarked place is in the two-seat Lead Auditor row.

Is CISA compulsory for Cyber Security Analyst? Not specifically under its published mandatory list; one of CEH, ISO 27001 Lead Auditor, an eligible database certificate or an eligible cloud certificate is listed. CISA is explicitly mandatory for Lead Auditor and the two other senior DoS specialist profiles.

Is a CISA holder with two years experience eligible for Lead Auditor? No under the stated experience test. Lead Auditor requires eight IT years including five BFSI technology/IS audit years and audit team leadership experience.

Can I register on 10 November? No. The official portal gives 26 October for registration and online fee; 10 November is only a printing deadline.

Does ₹40 lakh mean ₹40 lakh in-hand? No. It is the upper end of an annual consolidated range for Lead Auditor, before applicable statutory/tax and individual offer considerations.