Cybersecurity Architecture & Governance Lead

National e-Governance Division; New Delhi; On-site; INR 5,000,000 - 7,000,000; Full time

Job summary

National e-Governance Division seeks a Senior Leadership/Technical Lead to steer cybersecurity architecture, governance, risk, and compliance across government digital platforms and e-Governance programmes. The role requires deep technical insight and strong governance to shape security requirements for large-scale procurements.

You will guide security-by-design, manage complex RFPs, and coordinate with government departments, auditors, and partners to ensure proactive security posture and audit

Qualifications

• Bachelor’s degree in computer science, information technology, cybersecurity, engineering, or related discipline.
• 12-18+ years in cybersecurity, information security, security architecture, or enterprise risk management.
• Proven experience designing and reviewing security architectures for enterprisewide platforms.
• Experience preparing or evaluating complex cybersecurity RFPs, tenders, technical specifications, and vendor proposals.
• Strong understanding of governance, risk management, security audits, incident response, and regulatory compliance.

Responsibilities

• Define cybersecurity reference architectures, security standards, and design principles for digital platforms and shared services.
• Review security architectures across applications, infrastructure, cloud, API, IAM, network, database, and data protection.
• Establish controls for identity management, privileged access, encryption, key management, and secure connectivity.
• Guide Zero Trust, defence-in-depth, secure DevOps, and DevSecOps practices.
• Review threat models, architecture risks, and proposed security controls.
• Lead preparation and evaluation of complex RFPs, technical specifications, scoring matrices, and vendor proposals.
• Coordinate security audits, vulnerability assessments, penetration testing, configuration reviews, and remediation tracking.
• Define security policies, procedures, risk registers, and compliance reporting.
• Support security assurance and audit readiness for government digital infrastructure and applications.

Skills

Security architecture

Threat modelling

Risk assessment

Security frameworks

Governance

Education

Bachelor's degree in Computer Science or related

Postgraduate qualifications desirable

Tools

SOC/SIEM

SOAR

EDR/XDR

IAM/PAM

WAF

API security

Vulnerability management

Job description

Cybersecurity Architecture & Governance Lead

*This is a contractual job

Seniority: Senior Leadership / Technical Lead

Experience: 12-18+ years in Cybersecurity, Information Security, Security Architecture, or IT Risk Management

ROLE OVERVIEW

NeGD is seeking a senior cybersecurity professional to lead security architecture, cybersecurity governance, risk management, compliance, and security assurance across government digital platforms and e-Governance programmes. The role requires strong technical and governance expertise, including the ability to prepare and evaluate complex cybersecurity RFPs and define security requirements for large-scale procurements.

KEY RESPONSIBILITIES

Security Architecture & Engineering

• Define cybersecurity reference architectures, security standards, and security-by-design principles for digital platforms and shared technology services.
• Review applications, infrastructure, cloud, API, identity, network, database, and data security architectures.
• Establish controls for identity and access management, privileged access, encryption, key management, secrets management, and secure connectivity.
• Guide Zero Trust principles, defence-in-depth, secure DevOps, and DevSecOps practices.
• Review threat models, attack surfaces, architecture risks, and proposed security controls.

Cybersecurity Governance, Risk & Compliance

• Establish cybersecurity governance frameworks, risk assessment processes, security baselines, and control assurance mechanisms.
• Assess compliance with applicable CERT-In directions, MeitY guidelines, relevant Government of India security policies, and other applicable requirements.
• Coordinate security audits, vulnerability assessments, penetration testing, configuration reviews, and remediation tracking.
• Define security policies, procedures, risk registers, exception-management processes, and compliance reporting.
• Support security assurance and audit readiness for government digital infrastructure and applications.

Complex RFPs & Technical Evaluation

• Lead preparation and review of complex RFPs, SoWs, technical specifications, and procurement documents for cybersecurity products, services, and managed security operations.
• Define requirements for SOC/SIEM, SOAR, EDR/XDR, IAM/PAM, WAF, API security, vulnerability management, application security, and data protection.
• Develop security compliance matrices, technical evaluation criteria, scoring methodologies, SLAs, KPIs, and measurable acceptance criteria.
• Evaluate vendor proposals, security architectures, product capabilities, implementation approaches, licensing models, and total cost of ownership.
• Review managed security service provider proposals, SOC operating models, incident response capabilities, and service commitments.
• Identify gaps in vendor claims, interoperability, integration requirements, security coverage, licensing, and long-term operational costs.
• Support pre-bid meetings, technical clarifications, demonstrations, proof-of-concept assessments, and technical committee evaluations.

Security Operations & Incident Readiness

• Define security monitoring, incident response, escalation, reporting, and remediation frameworks.
• Oversee security posture assessments, threat intelligence integration, vulnerability prioritization, and risk-based remediation.
• Establish requirements for log management, audit trails, security event correlation, and evidence retention.
• Guide incident response exercises, disaster recovery security reviews, and cyber resilience assessments.
• Coordinate with relevant government security agencies, auditors, implementation partners, and incident response teams as required.

Application & Platform Security

• Review secure SDLC practices, source-code security, dependency management, container security, API protection, and CI/CD pipeline controls.
• Define requirements for SAST, DAST, software composition analysis, penetration testing, and vulnerability remediation.
• Evaluate security controls for cloud-native applications, microservices, shared platforms, and third-party integrations.
• Promote security automation, continuous compliance monitoring, and security testing throughout the development lifecycle.
• Integrate security-by-design controls throughout the AI Development Life Cycle (AIDLC), including AI-specific threat modelling, data protection, model security, validation, deployment, and continuous monitoring.

Leadership & Stakeholder Management

• Provide technical direction to project teams, cybersecurity consultants, auditors, and system integrators.
• Coordinate with government departments, programme owners, procurement teams, and senior management.
• Review security assessment reports, risk acceptance requests, audit findings, and remediation plans.
• Present cybersecurity risks, compliance status, investment priorities, and mitigation recommendations to senior leadership.

REQUIRED QUALIFICATIONS & EXPERIENCE

• Bachelors degree in computer science, Information Technology, Cybersecurity, Engineering, or a related discipline; relevant postgraduate qualifications are desirable.
• 12-18+ years of experience in cybersecurity, information security, security architecture, or enterprise risk management.
• Proven experience designing and reviewing security architectures for enterprise-scale or mission-critical platforms.
• Demonstrated experience preparing or evaluating complex cybersecurity RFPs, tenders, technical specifications, and vendor proposals.
• Strong understanding of cybersecurity governance, risk management, security audits, incident response, and regulatory compliance.
• Experience with government digital platforms, public-sector programmes, or regulated environments is highly desirable.
• Apply the AI Development Life Cycle (AIDLC) framework to assess, design, and govern secure cloud architectures for AI-enabled government platforms, ensuring cybersecurity-by-design across infrastructure readiness, data protection, identity and access management, secure model development, deployment, scalability, continuous monitoring, threat detection, compliance, risk management, and lifecycle optimization in alignment with government security standards and regulatory requirements.

TECHNICAL SKILLS

• Security architecture, threat modelling, risk assessment, and security control frameworks.
• Cloud security across AWS, Azure, and/or GCP.
• SOC/SIEM, SOAR, EDR/XDR, IAM/PAM, WAF, API security, and vulnerability management.
• Secure SDLC, DevSecOps, application security, container security, and CI/CD security.
• Security auditing, penetration testing oversight, incident response, and compliance reporting.
• RFP preparation, technical scoring matrices, SLA definition, and vendor assessment.

CERTIFICATIONS & PREFERRED EXPERIENCE

• Certifications such as CISSP, CISM, CCSP, or CISA are desirable.
• Cloud security, ISO 27001, or other recognized cybersecurity certifications are an advantage.
• Experience coordinating with CERT-In-empanelled auditors and STQC or other relevant assessment bodies is desirable, where applicable.

KEY COMPETENCIES

• Strong security architecture and risk-based decision-making.
• Excellent technical documentation, RFP drafting, and vendor evaluation skills.
• Ability to translate security risks into actionable technical and procurement requirements.
• Strong communication and stakeholder management capabilities.
• Ability to balance security, compliance, implementation feasibility, operational readiness, and cost.

EXPECTED OUTCOMES

• Consistent security architecture and governance across digital programmes.
• Improved cybersecurity posture, audit readiness, and risk visibility.
• Comprehensive, measurable, and technically sound cybersecurity procurement specifications.
• Effective vendor selection and improved security service accountability.
• Stronger incident preparedness and continuous security assurance.

Common expectation: The role requires independent assessment of complex technology proposals and the ability to balance technical suitability, security, compliance, lifecycle costs, scalability, and long-term sustainability.