General Manager Security Architecture

Job description

**POSITION DESCRIPTION** **General Manager Security Architecture** *Information Security* *•* *Enterprise Technology* **Function** Information Security – Architecture & Engineering **Reports to** CISO **Location** Bengaluru, India (hybrid) — global remit across US, India, Colombia, Philippines **Level** General Manager / Senior Leadership **Team** Security architects and domain specialists (application, infrastructure, cloud) **Role Purpose** Modern enterprises do not get breached in the application or in the infrastructure — they get breached in the space between them. APIs, data pipelines, service handoffs, and integration layers form a seam that traditionally has no single owner: application security regimes stop at the code boundary, infrastructure security regimes stop at the host and network boundary, and the integration fabric between them is under-governed by both. The General Manager – Security Architecture owns end-to-end security architecture across the enterprise — application security, infrastructure security, and, explicitly, the integration seam between them. The mandate is to design, standardise, and defend the security architecture of a hybrid, multi-cloud, high-volume data environment operating across four geographies and a 30,000+ workforce handling regulated healthcare data. **What This Role Is — and Is Not** **This is a security architecture role, not a GRC role.** The incumbent is a practising technologist who designs and reviews systems at the whiteboard and in the design document — not an audit, compliance, or risk-register manager. Candidates whose background is predominantly GRC, audit coordination, or compliance programme management will not be considered for this position, regardless of seniority. Familiarity with regulatory context (HIPAA, HITRUST, SOC 2) is expected as environmental literacy — it is not the job. **Key Responsibilities** **1. Enterprise Security Architecture Ownership** – Define and maintain the target-state security architecture, reference architectures, and reusable secure design patterns across on-premise, hybrid, and multi-cloud estates. – Chair the security design review board; every significant platform, product, and integration passes through architecture review with documented control decisions. – Set hardening and configuration baselines at the operating system level (Windows and Linux), and defend them against engineering pushback with technical argument, not policy citation. **2. Application Security Architecture** – Own secure-by-design standards across the SDLC: threat modelling, secure design review, cryptographic standards, secrets management, and AppSec tooling architecture (SAST, DAST, SCA, secrets scanning). – Define API security architecture end to end: authentication and authorisation models (OAuth 2.0, OIDC, mTLS, service-to-service trust), gateway patterns, schema and payload validation, rate limiting, and abuse detection. **3. Infrastructure Security Architecture** – Architect network segmentation, zero-trust access, identity and privileged-access architecture, and endpoint security integration across data centres and cloud. – Own workload security architecture in a multi-cloud environment: landing zones, container and Kubernetes security, infrastructure-as-code review, and cloud-native control selection (CSPM, DSPM, CNAPP alignment). **4. The Integration Seam — Explicit Mandate** – Own security architecture for the layer where application and infrastructure regimes meet: API gateways and service meshes, middleware and message queues, data ingestion and ETL/ELT pipelines, file-transfer and B2B handoffs, and third-party integrations. – For every material data flow, establish explicit control ownership at each hop — ingestion, staging, transformation, serving, consumption — so that no handoff is unowned and no control assumption is implicit. – Design trust boundaries and data-in-motion protections across environment transitions (on-prem to cloud, cloud to cloud, enterprise to partner). **5. Leadership and Advisory** – Lead and grow a team of security architects; raise the architectural bar across engineering and platform teams through patterns, enablement, and review — not gatekeeping. – Serve as principal technical advisor to the CIO and CISO on architecture-driven risk decisions, vendor and platform architecture evaluations, and security investment trade-offs. – Partner with SOC and detection engineering so that architecture decisions produce observable, defensible telemetry — architecture that cannot be monitored is architecture that cannot be defended. **Required Technical Depth** The successful candidate can do all of the following unaided, at a whiteboard: – **Operating systems.** Explain process, memory, privilege, and credential models on Windows and Linux, and derive hardening decisions from them rather than from checklists. – **Data flow architecture.** Draw a typical enterprise data path — ingestion, landing/staging, ETL/ELT transformation, warehouse/lake serving, API and reporting consumption — and place the correct control (and control owner) at every hop and handoff. – **API mechanics.** Articulate how APIs actually work: token issuance and validation, gateway versus service-level enforcement, east-west versus north-south traffic, schema validation, and common failure modes (BOLA/IDOR, token replay, over-permissive scopes). – **Hybrid and multi-cloud.** Deep working fluency in at least two of AWS, Azure, and GCP, including identity federation, network architecture, encryption and key management, and the security consequences of managed-service choices. – **Identity and network.** Zero-trust architecture, segmentation strategy, IAM/PAM design, and directory/federation architecture across a heterogeneous estate. – **Modern platforms.** Containers and Kubernetes, service mesh, CI/CD pipeline security, and infrastructure-as-code review. **Certificat