Job Description: Security Architect Role overview: The Security Architect is responsible for assessing, designing, reviewing, and governing security architectures across cloud infrastructure, enterprise applications, mobile applications, APIs, third-party SaaS platforms, and AI-enabled applications. The role ensures that security requirements are incorporated into solution architecture and design from the early stages of the development lifecycle through deployment and operations. The architect will identify security risks, recommend risk-based controls, define reusable security patterns and reference architectures, and work with engineering and operations teams to ensure that solutions align with enterprise security policies, standards, and regulatory obligations. 1. Key Responsibilities A. Security Architecture Reviews and Solution Design • Conduct security architecture and design reviews for new applications, existing applications, technology transformations, cloud migrations, and major architectural changes. • Assess architectures for web applications, mobile applications (Android and iOS), APIs, microservices, event-driven systems, serverless applications, containerized applications, and distributed systems. • Review solution architecture diagrams, data-flow diagrams, trust boundaries, network flows, authentication mechanisms, authorization models, and technology dependencies. • Identify security gaps, architectural weaknesses, attack surfaces, misconfigurations, and design-level risks. • Define security requirements and recommend appropriate preventive, detective, and corrective controls. • Evaluate solutions against enterprise security policies, technical standards, reference architectures, and security baselines. • Document findings, risk ratings, remediation recommendations, compensating controls, and residual risks. • Collaborate with solution architects, application teams, infrastructure teams, and business stakeholders to integrate security into solution design. B. Cloud Security Architecture • Perform security architecture reviews across AWS, Microsoft Azure, Google Cloud Platform (GCP), Oracle Cloud Infrastructure (OCI), and hybrid or on-premises environments. • Demonstrate a strong understanding of cloud service models, shared responsibility models, cloud-native services, landing zones, subscriptions/accounts, organizational hierarchies, and multi-account or multi subscription architectures. • Assess the security of IaaS, PaaS, cloud-native services, managed databases, storage services, serverless workloads, containers, Kubernetes, and platform services. • Design secure cloud architectures incorporating network segmentation, private connectivity, secure service-to-service communication, encryption, identity controls, centralized logging, and monitoring. • Evaluate cloud configurations for excessive permissions, public exposure, insecure management interfaces, insecure service configurations, and unintended trust relationships. • Assess the security implications of hybrid-cloud connectivity, cross-account access, cross-subscription communication, third-party integrations, and multi-cloud deployments. • Define and promote reusable cloud security patterns, approved architectural designs, and secure deployment blueprints. C. Application, API and Mobile Application Security • Conduct security reviews for web applications, mobile applications, APIs, microservices, backend services, and enterprise application integrations. • Understand common application security vulnerabilities, including injection, broken access control, authentication weaknesses, insecure session management, insecure data handling, and security misconfiguration. • Review application authentication and authorization flows, token handling, session lifecycle, API exposure, and service-to-service communication. • Assess mobile application security risks, including insecure local storage, sensitive data leakage, certificate validation weaknesses, reverse engineering, insecure backend APIs, and compromised-device scenarios. • Evaluate API gateway architectures, web application firewalls (WAFs), rate limiting, input validation, API authentication, authorization, and abuse prevention. • Review security implications of application frameworks, third-party libraries, open-source components, software supply chains, and external integrations. • Translate application security findings from penetration testing, SAST, DAST, SCA, and API security testing into actionable architecture improvements. • Apply secure software development lifecycle (SSDLC) principles and integrate security requirements into design, development, testing, and deployment. D. AI Application and Emerging Technology Security • Conduct security architecture reviews for AI-powered applications, large language model (LLM) solutions, retrieval-augmented generation (RAG), AI agents, and enterprise AI integrations. • Evaluate AI application architectures involving model providers, AI platforms, embedding services, vector databases, data pipelines, orchestration frameworks, and external tools. • Assess risks such as prompt injection, sensitive information disclosure, insecure output handling, excessive agency, insecure tool execution, and improper trust in model outputs. • Review AI agent and Model Context Protocol (MCP) architectures, including tool permissions, authentication, authorization, input and output validation, and execution boundaries. • Assess security controls for model access, AI gateways, API endpoints, model registries, prompts, embeddings, vector stores, and AI-related data flows. • Evaluate AI integration patterns involving enterprise identity providers, OAuth 2.0, OpenID Connect (OIDC), API keys, managed identities, and workload identities. • Define security requirements for AI application onboarding, approved AI services, third-party AI tools, AI governance, and production deployment. • Apply relevant AI security frameworks and guidance, including the NIST AI Risk Management Framework and OWASP guidance for LLM applications. E. Identity and Access Management (IAM), OAuth and API Security • Demonstrate strong knowledge of cloud IAM concepts, identity federation, role-based access control (RBAC), attribute-based access control (ABAC), privileged access management (PAM), and workload identities. • Understand the critical role of IAM in cloud security and its impact on the security of applications, infrastructure, APIs, data, and administrative operations. • Review authentication and authorization architectures involving enterprise identity providers, SSO, SAML 2.0, OAuth 2.0, OpenID Connect (OIDC), and modern federation protocols. • Understand OAuth flows, including Authorization Code with PKCE, Client Credentials, token issuance, access-token validation, refresh tokens, scopes, consent, and token lifecycle management. • Assess how applications securely obtain, store, use, rotate, and revoke client credentials, access tokens, refresh tokens, certificates, and API keys. • Review identity federation and cross-account or cross-tenant access, including trust policies, role assumptions, managed identities, and service principals. • Identify excessive permissions, overprivileged service accounts, shared identities, insecure trust relationships, hard-coded credentials, and inappropriate privilege escalation paths. • Design and recommend least-privilege access models, just-in-time access, strong authentication, privileged access controls, and periodic access reviews. • Evaluate OAuth-based integrations between enterprise applications, cloud-hosted workloads, and third party SaaS providers. F. Cloud Networking Security • Assess cloud network architectures, including virtual networks, VPCs, subnets, routing, security groups, network ACLs, firewalls, and network segmentation. • Review hub-and-spoke architectures, transit connectivity, hybrid-cloud networking, VPNs, dedicated private connections, and inter-cloud connectivity. • Evaluate private endpoints, private service access, public IP exposure, ingress and egress paths, DNS security, and service-to-service communication. • Review WAF, API gateway, reverse proxy, load balancer, CDN, and DDoS protection designs. • Understand Zero Trust network architecture and the application of identity-aware access, explicit verification, least privilege, and continuous assessment. • Identify network attack paths, exposed management interfaces, unrestricted outbound access, insecure routing, and unintended paths that could bypass approved security gateways. • Recommend network security controls that align with application architecture, business requirements, and risk exposure. G. Third-Party SaaS Security Architecture and Assessments • Conduct security assessments of third-party SaaS applications before onboarding, integration, significant architectural changes, and production deployment. • Assess SaaS architecture, authentication, SSO, provisioning, authorization, API integrations, data storage, encryption, tenant isolation, logging, and administrative access. • Evaluate SaaS integration patterns using OAuth 2.0, OIDC, SAML, SCIM, API keys, certificates, webhooks, and service accounts. • Determine whether required controls are supported natively by the SaaS provider or must be enforced through enterprise security services such as the identity provider, CASB/SSPM, SIEM, PAM, or API security gateways. • Assess external attack surfaces, public endpoints, API exposure, network connectivity, data flows, and dependencies on subcontractors or other service providers. • Review vendor security documentation, independent assurance reports, penetration-testing evidence, vulnerability management practices, incident response capabilities, and contractual security commitments. • Identify gaps between vendor capabilities and enterprise security requirements; recommend remediation, compensating controls, risk acceptance, or rejection where necessary. • Document SaaS security assessment results, applicability of controls, ownership, residual risks, and approval recommendations. H. Threat Modelling and Risk Assessment • Conduct threat modelling for cloud infrastructure, application architectures, APIs, mobile applications, AI solutions, and third-party integrations. • Identify assets, threat actors, entry points, trust boundaries, data flows, attack surfaces, abuse cases, and potential attack paths. • Apply suitable threat-modelling methodologies such as STRIDE, attack trees, data-flow analysis, and scenario-based risk assessment. • Analyse threats associated with misconfiguration, insecure identities, privilege escalation, data exfiltration, exposed services, compromised credentials, and supply-chain compromise. • Evaluate threats associated with cloud control planes, management APIs, container platforms, serverless services, AI models, agentic workflows, and external tools. • Assess likelihood, business impact, exploitability, exposure, and potential consequences to determine risk severity. • Recommend risk-based controls and validate whether residual risk is acceptable. • Maintain traceability between threats, identified risks, security requirements, remediation actions, and risk acceptance decisions. I. Zero Trust Architecture and Secure Design Principles • Apply Zero Trust principles to cloud infrastructure, enterprise applications, APIs, workloads, and data access. • Understand and implement secure design principles, including least privilege, defence in depth, secure defaults, fail-safe behaviour, separation of duties, complete mediation, and minimizing attack surface. • Design identity-centric access models that authenticate and authorize users, devices, workloads, and services based on contextual and risk-based requirements. • Apply segmentation, isolation, strong authentication, continuous monitoring, and explicit authorization to reduce lateral movement. • Ensure that security controls are enforced at appropriate layers rather than relying solely on network perimeter defenses. • Evaluate architectures for single points of failure, excessive trust, insecure dependencies, inadequate isolation, and weak security boundaries. • Promote security-by-design and privacy-by-design throughout the solution lifecycle. J. Cloud Security Governance, Policies and Standards • Develop, maintain, and implement enterprise cloud security policies, standards, technical baselines, reference architectures, and security patterns. • Translate enterprise security policies into actionable technical requirements for cloud platforms, applications, data, IAM, networking, and operations. • Establish and maintain security architecture review processes, approval criteria, security exceptions, risk acceptance workflows, and remediation tracking. • Define control ownership and accountability across Security Architecture, Cloud Engineering, Application Engineering, IAM, DevOps, SOC, and business teams. • Establish cloud security governance requirements for new services, cloud adoption, account or subscription onboarding, application deployment, and technology changes. • Assess cloud security posture against defined baselines and applicable regulatory, contractual, and organizational requirements. • Establish mechanisms for monitoring control implementation, measuring compliance, reporting risk, and tracking remediation. • Promote security automation and policy-as-code to improve consistency, reduce manual effort, and prevent noncompliant deployments. K. Cloud Platform and Infrastructure Security • Review security controls for virtual machines, operating systems, containers, Kubernetes clusters, serverless functions, managed databases, storage, and cloud platform services. • Assess infrastructure provisioning practices and recommend controlled deployment through Infrastructure as Code (IaC), approved templates, and governed CI/CD pipelines. • Review Terraform, CloudFormation, and other infrastructure automation for insecure configurations, excessive permissions, exposed resources, and policy violations. • Assess secrets management, certificate management, encryption, configuration hardening, patch management, vulnerability remediation, and workload isolation. • Evaluate container image security, cluster access controls, workload identities, admission controls, runtime security, and Kubernetes network policies. • Review cloud security posture management (CSPM), cloud-native application protection platforms (CNAPP), cloud detection and response (CDR), and workload protection capabilities. • Identify opportunities to embed security controls into cloud engineering workflows and automated deployment pipelines. L. Cloud Security Operations and Monitoring • Understand how architectural decisions affect security monitoring, incident detection, investigation, containment, and recovery. • Define logging, auditability, telemetry, and ing requirements for cloud control planes, applications, identities, APIs, and workloads. • Ensure security-relevant logs are integrated with enterprise SIEM and monitoring platforms and are retained according to organizational requirements. • Review cloud detection and response use cases, threat detection coverage, escalation processes, and incident response requirements. • Work with SOC and Cloud Security Operations teams to address visibility gaps, detection limitations, false positives, and recurring security incidents. • Assess whether critical workloads, identities, data stores, and exposed services have appropriate monitoring and response coverage. • Recommend preventive and detective controls that reduce risk while supporting operational resilience and business continuity. • Support security incident investigations by analyzing architectural weaknesses, attack paths, and opportunities for control improvements. M. Cloud Data Security and Privacy • Assess data classification, ownership, storage, processing, transfer, sharing, retention, and deletion requirements. • Review encryption at rest and in transit, key management, secrets management, tokenization, masking, and access controls. • Evaluate security of cloud storage, databases, data lakes, analytics platforms, backups, snapshots, and disaster recovery environments. • Assess data exposure risks arising from public access, cross-account sharing, excessive permissions, insecure APIs, and third-party integrations. • Define controls for sensitive data discovery, access monitoring, exfiltration prevention, and secure data lifecycle management. • Review data residency, privacy, retention, and cross-border transfer requirements where applicable. • For AI solutions, assess risks involving training data, prompts, embeddings, vector databases, retrieval pipelines, model outputs, and sensitive information leakage. N. Security Controls Planning and Implementation • Convert architecture review findings and threat assessments into clearly defined, prioritized, and measurable security controls. • Develop control implementation plans covering control objectives, technical requirements, ownership, dependencies, implementation timelines, and validation criteria. • Work with engineering teams to select and implement appropriate controls using native cloud capabilities and enterprise security tooling. • Define preventive, detective, corrective, and compensating controls based on business risk and technical feasibility. • Validate control effectiveness through design reviews, configuration assessments, evidence collection, testing, and operational feedback. 6 • Track remediation actions, exceptions, residual risks, and overdue security findings. • Ensure that controls are operationally sustainable and integrated into established engineering and security operations processes. O. Reference Architectures and Security Patterns • Develop and maintain reusable security reference architectures for cloud platforms, enterprise applications, APIs, mobile applications, AI applications, and SaaS integrations. • Create architecture patterns for IAM, OAuth-based integrations, Zero Trust, network segmentation, secure data access, secrets management, logging, and threat detection. • Define approved architectural patterns for RAG applications, AI gateways, AI agents, MCP servers, and model integrations where applicable. • Establish architecture decision records, security design guidance, reusable diagrams, control mappings, and implementation examples. • Ensure reference architectures remain aligned with evolving threats, cloud-native capabilities, enterprise standards, and business requirements. • Enable engineering teams to adopt secure-by-default designs and accelerate security reviews through standardized patterns. 2. Required Technical Knowledge and Skills The candidate should demonstrate practical understanding and the ability to apply the following concepts during architecture reviews. Technical domain Required knowledge Cloud platforms AWS, Azure, GCP, OCI, IaaS, PaaS, cloud-native services, shared responsibility Application security Web, microservices, APIs, authentication, authorization, secure SDLC Identity and access IAM, RBAC, ABAC, federation, SSO, PAM, workload identities OAuth and API security OAuth 2.0, OIDC, SAML, JWT, PKCE, scopes, token validation, API gateways Cloud networking VPC/VNet, segmentation, private endpoints, firewalls, WAF, DNS, hybrid connectivity Threat modelling STRIDE, attack trees, trust boundaries, data-flow diagrams, risk assessment Zero Trust Identity-centric access, explicit verification, least privilege, continuous assessment Cloud infrastructure IaC, Terraform, CloudFormation, containers, Kubernetes, serverless SaaS security Vendor assessments, SSO, SCIM, OAuth integrations, tenant isolation, external attack surface Cloud data security Security operations Encryption, KMS, secrets, classification, access control, data protection SIEM, CSPM, CNAPP, CDR, vulnerability management, incident response AI securi