Job Description

Key Responsibilities

• Define and evolve enterprise security architecture across AWS, Microsoft Azure and Google Cloud, aligned with business objectives, risk appetite and security strategy.
• Develop security reference architectures, blueprints, patterns, standards and guardrails for landing zones, data platforms, microservices, Kubernetes, serverless, APIs and hybrid connectivity.
• Own CNAPP strategy, product evaluation, capability mapping, target architecture, deployment model, operating model and multi-cloud adoption roadmap.
• Architect CSPM at enterprise scale, including organizational hierarchy, policy design, compliance mapping, exceptions, risk scoring, data residency and reporting.
• Architect CWPP coverage for VMs, containers, Kubernetes and serverless workloads, balancing agent and agentless approaches, prevention, detection, runtime protection and operational overhead.
• Define CIEM architecture and least-privilege governance across federated identities, cloud-native roles, service accounts, managed identities and workload identities.
• Design shift-left controls for IaC, repositories, registries and CI/CD pipelines, including policy-as-code, security gates and controlled exception paths.
• Conduct advanced threat modelling, cloud-security maturity assessments, risk assessments, posture reviews and architecture design reviews.
• Design cross-cloud identity, network segmentation, encryption, key and secret management, data protection, logging, monitoring and incident-response patterns.
• Translate NIST, ISO 27001, CIS Benchmarks, PCI DSS, SOC 2, GDPR, HIPAA and customer obligations into implementable technical controls and evidence requirements.
• Define CNAPP integration architecture for SIEM/SOAR, ITSM, identity, DevOps and governance platforms and establish automated or approval-based remediation patterns.
• Lead complex technical investigations, proofs of concept, critical escalations and design decisions and provide final architecture guidance.
• Create transformation roadmaps, maturity models, control ownership models, metrics, executive dashboards and continuous-compliance governance.
• Provide design authority, mentor L1 and L2 teams and communicate security risk and investment priorities to engineering, operations and senior stakeholders.

͏

Technical Qualifications / Knowledge

• Extensive cloud-security architecture and engineering experience, with strong hands-on knowledge across at least two of AWS, Azure and GCP and working knowledge of the third.
• Architecture and implementation experience with one or more CNAPP platforms such as Prisma Cloud, Wiz, Lacework or CrowdStrike CNAPP.
• Deep knowledge of CSPM, CWPP, CIEM, IaC security, attack-path analysis, vulnerability management, container security, Kubernetes security and runtime protection.
• Expert knowledge of cloud identity federation, RBAC, ABAC, privileged access, service identities, workload identities and least-privilege design.
• Expert knowledge of AWS Organizations and Control Tower, Azure subscription and tenant governance, GCP organization policies, secure landing zones, network segmentation, private connectivity, WAF, DDoS protection and hybrid-cloud security.
• Ability to design Azure tenant-migration approaches for subscriptions, roles, managed identities, RBAC, Key Vault and secrets.
• Knowledge of product best-fit analysis across cloud-native and third-party controls, including API, endpoint, data, threat-intelligence, exposure and incident-management requirements.
• Strong knowledge of data classification, encryption, KMS or HSM design, secrets management, DLP and protection of data at rest and in transit.
• Architecture experience integrating CNAPP with Sentinel, Splunk, Cortex XSOAR, ServiceNow, Jira, Jenkins, GitLab CI, Azure DevOps and GitHub Actions.
• Ability to design policy-as-code, automated compliance validation, risk-based remediation and measurable control-coverage models.
• Ability to create architecture decision records, reference designs, threat models, control mappings, exception standards and executive-level security roadmaps.
• Strong consulting, customer-facing communication, stakeholder influence, technical leadership and architecture-governance skills.

Preferred Certifications

PCCSE or equivalent CNAPP certification; AWS Solutions Architect – Professional or Security – Specialty; Microsoft SC-100 or AZ-305; Google Professional Cloud Security Engineer or Cloud Architect; CISSP, CCSP, SABSA or TOGAF desirable.